CVE-2026-41161 Username Enumeration via Timing Attack
Unauthenticated attackers can enumerate valid usernames by measuring response times on the login endpoint, exposing user account existence.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41161?
CVE-2026-41161 is a medium-severity vulnerability in Sync-in server, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.2.0, the /api/auth/login endpoint contains a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring the application's response time. This issue has been patched in version 2.2.0.
Weakness: CWE-208
Which versions are affected by CVE-2026-41161?
2 open source packages ship an affected version, including @sync-in/server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@sync-in/server npm | All versions | 2.2.0 |
@sync-in/server npm | All versions | 2.2.0 |
Products include Sync-in Sync-in Server.
How do I fix CVE-2026-41161?
Upgrade @sync-in/server to 2.2.0 or later.
Is CVE-2026-41161 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41161 exists.
Other vulnerabilities in Sync-in server
Sources
Also known as GHSA-43fj-qp3h-hrh5.