6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41161

CVE-2026-41161: Sync-in Server has Username Enumeration via Timing Attack

Summary

The /api/auth/login endpoint contains a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring the application's response time.

Details

The logic flaw can be located at the below point in source: https://github.com/Sync-in/server/blob/7868bb2b3025f92e6c38087456304758713971b2/backend/src/applications/users/services/users-queries.service.ts#L91-L95

Endpoints used for authentication should respond to the user with a consistent cadence, preventing remote actors from deriving sensitive information about an application based on backend behavior. In the case of authentication endpoints, this timing discrepancy is often caused by short-circuiting due to the lack of a matched user to compare against - as is the case with Sync-in.

Validation

TickTock Enum (Burp Suite Extension) was utilized to validate this finding. Authentication attempts with a valid username see a response from the application at around 350-400ms on average, while invalid usernames are returned at only 95-100ms on average. <img width="1302" height="284" alt="image" src="https://github.com/user-attachments/assets/31eeb72a-c3c2-4057-ac69-c0c92f0bbd4e" />

Impact

An unauthenticated remote attacker can enumerate valid usernames. This significantly weakens the application's security posture by facilitating targeted brute-force attacks, stuffing, social engineering, and a suite of other more targeted attacks.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41161

CVE-2026-41161:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@sync-in/server	npm	<= 2.1.0	2.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a username enumeration timing attack in the login process. The root cause lies in the UsersQueries.compareUserPassword function, which had a conditional early exit if a user was not found. This resulted in a faster response time for invalid usernames compared to valid ones, allowing an attacker to distinguish between them by measuring response times.

The fix involves two key changes. First, the early exit in UsersQueries.compareUserPassword was removed. Instead, it now always calls the comparePassword function, passing a null hash for non-existent users. Second, the comparePassword function was updated to handle null hashes by performing a password comparison against a static, dummy hash. This ensures that the code path and, critically, the execution time, remain consistent for both valid and invalid user lookups, thereby eliminating the timing oracle.

Vulnerable functions

UsersQueries.compareUserPassword

backend/src/applications/users/services/users-queries.service.ts

This function is vulnerable to a timing attack. Before the patch, it would immediately return `false` if a user corresponding to the `userId` was not found. This created a significant difference in response time compared to when a user was found, which would then proceed to the more time-consuming password comparison step. An attacker could abuse this timing difference to enumerate valid user IDs.

comparePassword

backend/src/common/functions.ts

This function was modified to mitigate the timing attack vulnerability. The original version did not account for a missing password hash. The patched version introduces a constant-time comparison by using a dummy hash when the user's hash is not provided. This ensures that the execution time is consistent whether a user exists or not, preventing an attacker from using timing discrepancies to enumerate users.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.