CVE-2026-54047

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54047
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54047.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54047
Aliases
  • GHSA-gq4p-pxvg-6x9j
Published
2026-09-11T16:23:48Z
Modified
2026-09-12T03:46:42Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Laci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration Manipulation
Details

Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to 1.2.3 have an improper authentication vulnerability in the application's OAuth2 login flow. The application relies on client-side state by trusting the UID field inside the Authentications object of a user's local config.json file. By manually editing this local file on their PC prior to logging in, a user can supply an arbitrary UID. Because the server fails to validate that the authenticated OAuth2 identity matches the requested UID, an attacker can fully impersonate any target user and perform actions on their behalf. This issue has been resolved in version 1.2.3. The patch modifies AuthorizeOauthAsync inside the SecretKeyAuthenticatorService to strictly bind the lookup of the requested User ID (requestedUid) to the record of the successfully authenticated identity (primaryUid). The server will no longer load or return session tokens for a requested UID unless it matches the verified, authenticated database record. No known workarounds are available.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-287",
        "CWE-349",
        "CWE-602"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54047.json"
}
References

Affected packages

Git / github.com/lacisynchroni/server

Affected ranges

Type
GIT
Repo
https://github.com/lacisynchroni/server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5bc3efd68b738328b8faeff089dd18a826ec9ca4
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.2.3"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v1.*
v1.2.0
v1.2.1
v1.2.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54047.json"