The vulnerability allows an attacker to repeatedly send registration requests with a guessed time‑based OTP; the lockout mechanism never activates due to an oversight that prevents the attempt counter from incrementing. A successful OTP guess grants the attacker a client ID and token pair. The token can be exchanged for a full JWT, and the attacker can then call an endpoint to permanently disable two‑factor authentication for the user, removing an important security boundary and enabling ongoing session hijacking or data exfiltration.

Sync‑In team’s open‑source server platform is affected for all releases older than version 2.4.0. Users running those versions with the registration endpoint exposed are at risk.

The CVSS score of 6.8 indicates that the issue is a moderate‑severity flaw that could allow attackers to gain privileged access. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalogue, so there is no evidence of active exploitation at this time. The attack vector is inferred to be network‑based: an attacker who can reach the registration API can launch brute‑force attempts against a user’s OTP. Once an OTP is discovered, the attacker can obtain a session token and disable MFA, thereby achieving long‑term compromise of the target account.