External risk intelligence

Laci Synchroni Improper Authentication Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-54047

The vulnerability exists in a server-side component (Laci Synchroni) designed to act as a sync server for clients. As a server application providing authentication and data synchronization services, it is typically deployed as a reachable network service or API endpoint to facilitate communication between distributed users.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns an improper authentication vulnerability in the Laci Synchroni backend, which is a sync server and plugin for Dalamud. The flaw allows an attacker to impersonate any user by manipulating local configuration files before logging in, potentially leading to unauthorized actions. The main concern is confirming relevance and exposure.

A server's login process can be tricked.
Attackers can impersonate users and act as them.
Confirm if this server technology is in use.

Attack Path

How an attacker could exploit the issue

An attacker could impersonate any user by manipulating a local configuration file before logging in, as the server does not adequately verify the user's identity during the OAuth2 authentication process. This allows the attacker to then perform actions on behalf of the impersonated user.

Requires access to a user's local configuration file.
Triggers by supplying an arbitrary User ID.
Allows full user impersonation and unauthorized actions.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to impersonate any user of the Laci Synchroni server. This impersonation may occur when the server incorrectly trusts a user-provided identifier in a local configuration file instead of verifying the authenticated OAuth2 identity. As a result, an attacker could potentially perform actions on behalf of any user.

User account data.
Arbitrary UID supplied via local file.
Full user impersonation and unauthorized actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Laci Synchroni backend is likely managed by the platform or infrastructure team responsible for its deployment. The first practical step is to identify all instances of the affected backend, determine their reachability and criticality, and then assign ownership for remediation planning.

Platform/Infrastructure teams own the issue.
Verify instance reachability and criticality.
Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Laci Synchroni?

Laci Synchroni is a specialized backend server and plugin for Dalamud, a framework often used for customizing gameplay experiences. It functions as a decentralized hub that synchronizes mods and appearance data between different users. By centralizing these assets, it allows participants to see the same customized visual environment, making it a critical component for users who rely on the server to manage and distribute their synchronized data profiles.

How does CVE-2026-54047 affect security?

This vulnerability involves improper authentication, categorized under CWE-287, CWE-349, and CWE-602. It occurs because the server blindly trusts a user-supplied ID from a local configuration file during the OAuth2 login process. Instead of verifying the user's identity against the trusted OAuth2 provider, the server accepts the manipulated ID as legitimate. This logic error allows an attacker to bypass security checks and successfully masquerade as any other user registered on the system.

What triggers the impersonation flaw?

The vulnerability is triggered when a user modifies their local 'config.json' file to inject an arbitrary User ID before initiating the login flow. Simply logging in with standard, unmodified settings does not trigger the bug. The issue only manifests because the server fails to validate that the provided User ID matches the identity confirmed by the OAuth2 provider, effectively allowing the client-side input to override the server's actual authentication record.

Is my server exposed to this vulnerability?

According to Halo Surface Signal, this vulnerability is likely relevant if you operate a Laci Synchroni instance, as these servers are typically exposed to the network to allow remote clients to connect and sync data. Because the flaw exists in the authentication logic of the server component itself, any instance that accepts connections from users is potentially reachable by an attacker attempting to impersonate others through the flawed login process.

How do I fix this security issue?

The primary response is to update the Laci Synchroni backend software to version 1.2.3 or later. This release addresses the vulnerability by modifying how the server processes login requests. The update forces the server to strictly bind the requested User ID to the record verified by the OAuth2 provider, ensuring that users can only access accounts that they have been properly authenticated to use. You should verify your current deployment version and plan for an immediate upgrade.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.