Authentication Bypass in Laci Synchroni (CVE-2026-54047)
Summary
Authentication bypass in Laci Synchroni (CVE-2026-54047). Risk of unauthorized operations or information disclosure. Exploitable via UID.
Original description
The description as published by the source.
Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to 1.2.3 have an improper authentication vulnerability in the application's OAuth2 login flow. The application relies on client-side state by trusting the UID field inside the Authentications object of a user's local config.json file. By manually editing this local file on their PC prior to logging in, a user can supply an arbitrary UID. Because the server fails to validate that the authenticated OAuth2 identity matches the requested UID, an attacker can fully impersonate any target user and perform actions on their behalf. This issue has been resolved in version 1.2.3. The patch modifies AuthorizeOauthAsync inside the SecretKeyAuthenticatorService to strictly bind the lookup of the requested User ID (requestedUid) to the record of the successfully authenticated identity (primaryUid). The server will no longer load or return session tokens for a requested UID unless it matches the verified, authenticated database record. No known workarounds are available.
Source: NIST National Vulnerability Database NVD
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-54047 has been found in Laci Synchroni.
Attackers can target a specific entry point like UID over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "Laci Synchroni CVE-2026-54047" on the vendor's site.
CVE-2026-54047 (Laci Synchroni) — CWE-287
Attack surface: UID / Authentications / AuthorizeOauthAsync / SecretKeyAuthenticatorService
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
Authentication bypass (CWE-287) exists in Laci Synchroni. Attackers reach the vulnerable code path via UID.
Check the vendor advisory for the affected versions of Laci Synchroni. Attack surface: UID / Authentications / AuthorizeOauthAsync / SecretKeyAuthenticatorService.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to the patched release per vendor advisory.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
Audit SBOM/dependencies for affected components.資産台帳・SBOM・依存マニフェストで Laci Synchroni を使っているサービスとバージョンを洗い出す。
-
2Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。