Username enumeration via short-circuited password comparison

Observable timing discrepancy in Sync-in Server before 2.2.0 allows remote attackers to enumerate valid usernames through login requests. The /api/auth/login path calls UsersQueries.compareUserPassword, which returns immediately when no matching user hash exists but runs bcrypt comparison for a known user. No authentication or user interaction is required; repeated timing samples disclose account names and support targeted credential attacks.