Sync‑in Server’s authentication endpoint /api/auth/token fails to validate whether a user has two‑factor authentication enabled before issuing full‑access JWTs. An attacker who has obtained or phished valid credentials can submit a single POST request to this endpoint and receive the bearer token without completing the second‑factor step, effectively bypassing all 2FA controls. The vulnerability is classified as an improper authentication flaw (CWE‑288) and can compromise confidential files and shared data on the platform.

The issue exists in all Sync‑in Server releases prior to version 2.4.0. Users running any 2.x build below 2.4.0 are exposed. The vendor has released a patch in version 2.4.0 that enforces 2FA on the token endpoint.

The CVSS score of 8.1 indicates high severity, and an attacker only needs stolen or phished credentials to exploit the flaw. No special environment or privilege is required beyond a network connection to the API. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the documented attack path and high score suggest significant risk if left unpatched.