{"vulnerability": "cve-2026-58271", "sightings": [{"uuid": "4f93c22d-8b4b-408c-8d80-534042d72cb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-58271", "type": "published-proof-of-concept", "source": "https://github.com/Sync-in/server/security/advisories/GHSA-274f-6w77-8qm9", "content": "", "creation_timestamp": "2026-09-22T16:35:15.051586Z"}, {"uuid": "e143dab4-2384-4793-8281-63d0353364a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58271", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117393339322216713", "content": "CVE-2026-58271 Sync-in: lockout bypass on /api/app/sync/register lets attackers brute-force TOTP codes indefinitely, failed attempts never increment the counter. CVSS 6.8. Fix is still under review, so restrict endpoint https://www.valtersit.com/cve/CVE-2026-58271/ #CVE #infosec #cybersecurity", "creation_timestamp": "2026-10-06T09:50:04.479292Z"}]}