SyncBreeze 10.0.28 - 'login' Denial of Service | Advisories

Advisories

SyncBreeze 10.0.28 - 'login' Denial of Service

severity: high
date: January 27, 2026
Affecting: SyncBreeze 10.0.28
CVE: CVE-2020-36946
CWE: CWE-770 Allocation of Resources Without Limits or Throttling
CVSS: 8.7
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References: ExploitDB-49291
Vendor Homepage
Credit: Ahmed Elkhressy
Description: SyncBreeze 10.0.28 contains a denial of service vulnerability in the login endpoint that allows remote attackers to crash the service. Attackers can send an oversized payload in the login request to overwhelm the application and potentially disrupt service availability.