CVE-2026-54047

Laci Synchroni, a decentralized mod and appearance sync server and plugin for Dalamud (the Final Fantasy XIV plugin framework), contains an improper authentication flaw (CWE-287) in its backend's OAuth2 login flow in versions prior to 1.2.3. The backend trusts the UID field inside the Authentications object of the user's local config.json file, so a user who manually edits that file before logging in can present an arbitrary UID that the server does not validate against the successfully authenticated OAuth2 identity. As a result, an attacker can obtain a session for a chosen UID and fully impersonate another user, performing actions on their behalf. Operators and users running the Synchroni backend before 1.2.3 are affected; the flaw is rated 9.2 (critical) under CVSS 4.0 and there are no known workarounds. No public proof-of-concept or in-the-wild exploitation is known, and version 1.2.3 fixes the issue by strictly binding the requested UID to the verified authenticated identity in SecretKeyAuthenticatorService.AuthorizeOauthAsync.

What to do: Operators running the Synchroni backend should upgrade to version 1.2.3 or later, which strictly binds the requested UID (requestedUid) to the verified authenticated identity (primaryUid) in SecretKeyAuthenticatorService.AuthorizeOauthAsync; there are no workarounds, so patching is the only remediation. Plugin users should confirm with their sync server operator that the backend has been updated, since a vulnerable backend lets any authenticated user impersonate others. No in-the-wild exploitation or public proof-of-concept is known.