CVE-2026-54047: Laci Synchroni OAuth2 Auth Bypass Flaw

CVE-2026-54047 Overview

Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to 1.2.3 contain an improper authentication vulnerability [CWE-287] in the OAuth2 login flow. The server trusts the client-supplied UID field inside the Authentications object of a local config.json file. An attacker can edit that file to supply an arbitrary UID and impersonate any target user. The server fails to validate that the authenticated OAuth2 identity matches the requested UID. Version 1.2.3 resolves the issue.

Critical Impact

Any authenticated user can fully impersonate any other Laci Synchroni account and perform actions on their behalf without additional credentials.

Affected Products

• Laci Synchroni server backend versions prior to 1.2.3
• Laci Synchroni Dalamud plugin clients using affected backend versions
• Deployments relying on the OAuth2 login flow for authentication

Discovery Timeline

• 2026-09-11 - CVE-2026-54047 published to NVD
• 2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-54047

Vulnerability Analysis

The vulnerability resides in the AuthorizeOauthAsync method within SecretKeyAuthenticatorService. During OAuth2 login, the server accepts a requestedUid value derived from the client's local configuration file. The backend then looks up authentication records by that requestedUid without confirming it belongs to the primaryUid produced by the successful OAuth2 exchange. This decoupling allows any authenticated identity to request session tokens tied to a different account. The result is full account impersonation across the sync service.

Root Cause

The server violated the principle that authorization decisions must be bound to a server-verified identity. The Authentications object in the client-side config.json was treated as authoritative for the target UID. No cross-check ensured that the OAuth2-authenticated primaryUid owned the requestedUid record before returning session tokens.

Attack Vector

An attacker with any valid OAuth2 identity edits their local config.json before login and inserts a target victim's UID into the Authentications object. They then initiate the OAuth2 login flow. The server authenticates the attacker's real identity but issues session tokens bound to the victim's UID. The attacker gains full control of the victim's sync account over the network without user interaction.

         var authUser = await context.Auth.SingleOrDefaultAsync(u => u.UserUID == primaryUid).ConfigureAwait(false);
         if (authUser == null) return AuthenticationFailure(ip!);
 
-        var authReply = await context.Auth.Include(a => a.User).AsNoTracking()
+        var authReply = await context.Auth
+            .Where(auth => auth == authUser)
+            .Include(a => a.User).AsNoTracking()
             .SingleOrDefaultAsync(u => u.UserUID == requestedUid).ConfigureAwait(false);
         return await GetAuthReply(ip!, context, authReply);
     }

Source: GitHub Commit 5bc3efd. The patch constrains the Auth query to records belonging to the authenticated authUser, so a mismatched requestedUid cannot return a session.

Detection Methods for CVE-2026-54047

Indicators of Compromise

• Server authentication logs showing successful OAuth2 logins where the authenticated identity differs from the returned session UID.
• Multiple sessions for a single user account originating from unrelated IP addresses within short time windows.
• Unexpected mod or appearance sync changes on user profiles that the account owner did not initiate.

Detection Strategies

• Review historical SecretKeyAuthenticatorService invocations for cases where primaryUid and requestedUid do not match.
• Correlate OAuth2 provider identity claims with the returned UserUID in issued session tokens.
• Alert on session-token issuance patterns where the same OAuth2 identity retrieves tokens for multiple distinct UIDs.

Monitoring Recommendations

• Enable verbose authentication logging on the Laci Synchroni backend and forward logs to a centralized SIEM for retention and analysis.
• Track per-account session creation velocity and geolocation deltas to surface impersonation activity.
• Monitor GitHub advisory feeds for follow-up disclosures related to GHSA-gq4p-pxvg-6x9j.

How to Mitigate CVE-2026-54047

Immediate Actions Required

• Upgrade the Laci Synchroni server backend to version 1.2.3 or later without delay.
• Invalidate all active session tokens and force re-authentication for every user after upgrading.
• Audit account activity logs since deployment to identify any accounts that may have been impersonated.

Patch Information

The fix is available in Laci Synchroni server v1.2.3. The patch modifies AuthorizeOauthAsync inside SecretKeyAuthenticatorService to bind the requestedUid lookup to the authenticated authUser record. See the pull request discussion and the security advisory GHSA-gq4p-pxvg-6x9j for full context.

Workarounds

• No known workarounds are available. Upgrading to version 1.2.3 is the only supported remediation.
• Operators unable to patch immediately should consider taking the OAuth2 login flow offline until the upgrade is completed.

# Upgrade the Laci Synchroni server backend to the patched release
git fetch --tags
git checkout v1.2.3
# Rebuild and restart the backend service per your deployment process