CVE-2026-54047 in server
Summary
by MITRE • 09/11/2026
Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to 1.2.3 have an improper authentication vulnerability in the application's OAuth2 login flow. The application relies on client-side state by trusting the `UID` field inside the `Authentications` object of a user's local `config.json` file. By manually editing this local file on their PC prior to logging in, a user can supply an arbitrary UID. Because the server fails to validate that the authenticated OAuth2 identity matches the requested UID, an attacker can fully impersonate any target user and perform actions on their behalf. This issue has been resolved in version 1.2.3. The patch modifies `AuthorizeOauthAsync` inside the `SecretKeyAuthenticatorService` to strictly bind the lookup of the requested User ID (`requestedUid`) to the record of the successfully authenticated identity (`primaryUid`). The server will no longer load or return session tokens for a requested UID unless it matches the verified, authenticated database record. No known workarounds are available.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in Laci Synchroni versions prior to 1.2.3 represents a critical failure in authentication logic within its OAuth2 implementation, specifically categorized under CWE-287 Improper Authentication and CWE-640 Weak Password Recovery Mechanisms for Forgotten Passwords due to the reliance on client-side state. As a decentralized mod and appearance synchronization server integrated with Dalamud, this application handles sensitive user identity data and session management. The core technical flaw stems from an insecure trust model where the backend service accepts the User Identifier (UID) provided by the client within the local configuration file without performing adequate server-side validation against the actual authenticated OAuth2 token payload. This architectural decision violates fundamental security principles regarding state management, as it places critical authentication data in a context that is fully controllable by the end-user rather than maintaining integrity through secure, server-managed sessions or tokens.
During the login process, an attacker can exploit this flaw by manually editing their local config.json file to replace their own UID with that of any other target user before initiating the OAuth2 authentication flow. Because the application's AuthorizeOauthAsync method in the SecretKeyAuthenticatorService fails to verify that the requested UID matches the identity established during the successful OAuth2 handshake, the server proceeds to generate and issue session tokens for the impersonated account. This allows an attacker to bypass legitimate access controls entirely, effectively gaining full administrative control over another user's profile within the synchronization ecosystem. The operational impact is severe, as it enables complete account takeover without requiring any credentials or multi-factor authentication bypasses, leading to potential unauthorized modification of synchronized appearance data and mod configurations associated with the victim's identity.
This vulnerability aligns closely with MITRE ATT&CK technique T1078 Valid Accounts, where an adversary uses legitimate system accounts to gain access to resources, as well as CWE-345 Insufficient Verification of Data Authenticity. The lack of binding between the authenticated principal and the requested resource identifier creates a straightforward path for identity spoofing. Remediation was addressed in version 1.2.3 by modifying the authentication service logic to strictly bind the lookup of the requested User ID to the record of the successfully authenticated primary UID. This patch ensures that session tokens are only issued when there is cryptographic or logical consistency between the OAuth2-verified identity and the user account being accessed, thereby eliminating the possibility of arbitrary UID injection. No known workarounds exist for affected versions prior to this fix; users must upgrade immediately to version 1.2.3 or later to mitigate the risk of unauthorized access and data compromise within their Laci Synchroni environment.