CVE-2026-54047: Laci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration Manipulation
Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to 1.2.3 have an improper authentication vulnerability in the application's OAuth2 login flow. The application relies on client-side state by trusting the UID field inside the Authentications object of a user's local config.json file. By manually editing this local file on their PC prior to logging in, a user can supply an arbitrary UID. Because the server fails to validate that the authenticated OAuth2 identity matches the requested UID, an attacker can fully impersonate any target user and perform actions on their behalf. This issue has been resolved in version 1.2.3. The patch modifies AuthorizeOauthAsync inside the SecretKeyAuthenticatorService to strictly bind the lookup of the requested User ID (requestedUid) to the record of the successfully authenticated identity (primaryUid). The server will no longer load or return session tokens for a requested UID unless it matches the verified, authenticated database record. No known workarounds are available.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Laci Synchroni Backendto a version that resolves this vulnerability.Fixed in 1.2.3
Event History
Frequently Asked Questions
What access does an attacker need to impersonate another user?
The attacker needs local access to their own Laci Synchroni client configuration so they can edit the UID field in the Authentications object of config.json before logging in. They then authenticate through the OAuth2 flow while supplying an arbitrary target UID.
Which deployments are affected?
Backend versions earlier than 1.2.3 are affected. Version 1.2.3 changes the authorization logic to require the requested UID to match the UID of the successfully authenticated identity.
Can this be mitigated without upgrading?
No known workaround is available. Upgrading the backend to version 1.2.3 is the stated resolution.
What can an attacker do after successful exploitation?
An attacker can fully impersonate an arbitrary target user and perform actions on that user's behalf. The vulnerable server may load or return session tokens for the attacker-supplied UID without confirming it belongs to the authenticated identity.