CVE-2026-54047
Received Received - Intake

Improper Authentication in Laci Synchroni Backend

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: GitHub, Inc.

Description
Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to 1.2.3 have an improper authentication vulnerability in the application's OAuth2 login flow. The application relies on client-side state by trusting the `UID` field inside the `Authentications` object of a user's local `config.json` file. By manually editing this local file on their PC prior to logging in, a user can supply an arbitrary UID. Because the server fails to validate that the authenticated OAuth2 identity matches the requested UID, an attacker can fully impersonate any target user and perform actions on their behalf. This issue has been resolved in version 1.2.3. The patch modifies `AuthorizeOauthAsync` inside the `SecretKeyAuthenticatorService` to strictly bind the lookup of the requested User ID (`requestedUid`) to the record of the successfully authenticated identity (`primaryUid`). The server will no longer load or return session tokens for a requested UID unless it matches the verified, authenticated database record. No known workarounds are available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-54047
EUVD
EUVD-2026-76152

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
lacisynchroni server to 1.2.2 (exc)
lacisynchroni server 1.2.3
lacisynchroni server From 1.2.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-602 The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
CWE-349 The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54047 is an improper authentication vulnerability in Laci Synchroni, a decentralized mod and appearance sync server for Dalamud. Versions prior to 1.2.3 incorrectly rely on client-side state by trusting the UID field in a user's local config.json file during OAuth2 login. An attacker can manually edit this file to supply any UID, and since the server does not validate that the authenticated OAuth2 identity matches the requested UID, the attacker can impersonate any user and perform actions on their behalf.

Detection Guidance

Check if your Laci Synchroni server version is below 1.2.3 by inspecting the server logs or running version checks. Examine config.json files on client systems for unexpected UID values. Monitor for unauthorized actions performed by users who did not authenticate via OAuth2.

Impact Analysis

This vulnerability allows attackers to fully impersonate any user by manipulating their local config.json file before login. They can then perform actions as that user, potentially accessing sensitive data, modifying settings, or taking control of the user's account. The impact includes unauthorized access to user data, loss of data integrity, and potential disruption of service.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR mandates strict data protection and user consent, while HIPAA requires safeguards for protected health information. The improper authentication could lead to unauthorized data exposure, resulting in legal penalties and loss of trust.

Mitigation Strategies

Upgrade the Laci Synchroni server to version 1.2.3 or later immediately. There are no workarounds, so patching is required to prevent exploitation. Verify the patch by checking the AuthorizeOauthAsync method in SecretKeyAuthenticatorService.cs for the added validation filter.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54047. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart