Sync‑in Server versions earlier than 2.4.1 reveal a timing difference when a login attempt uses a nonexistent username or email address. The authentication routine skips the bcrypt check for missing accounts, returning a faster response. An attacker can measure these differences to determine which usernames or email addresses exist, facilitating credential‑stuffing, password‑spraying, and phishing attacks. The weakness is a classical timing side‑channel flaw (CWE‑208).

The affected product is Sync‑in Server. Versions older than 2.4.1 are impacted; the fix was released in release 2.4.1.

The CVSS score is 5.3, indicating moderate severity. EPSS data is not available, so the probability of exploitation is unclear, but the KEV catalog does not list this vulnerability, suggesting no active public exploits are known. Attackers can perform the enumeration without authentication by sending repeated POST requests to /api/auth/login and measuring response times, implying the vector is remote over HTTP/HTTPS and does not require privileged access.