Executive brief
Laci Synchroni is a decentralized mod and appearance synchronization server for the FFXIV modding community. Versions prior to 1.2.3 allow attackers to impersonate any user by editing a local configuration file before login, bypassing server-side identity validation. An attacker can take over any account and perform unauthorized actions on behalf of the victim.
Technical details
The vulnerability is an authentication bypass in the OAuth2 login flow caused by improper server-side validation of user identity. The vulnerable component is the `AuthorizeOauthAsync` method in `SecretKeyAuthenticatorService`, which fails to bind the authenticated OAuth2 identity to the requested user ID. An attacker with local file system access can modify the `UID` field in the `config.json` file before authentication to supply an arbitrary UID. The server then accepts the mismatch and issues session tokens for the impersonated account. Patched versions 1.2.3+ enforce strict validation that the requested UID matches the verified authenticated identity from OAuth2.
Affected products
- Laci Synchroni Synchroni prior to 1.2.3
Timeline
- 2026-09-11: disclosed
- 2026-06-01: patched: Version 1.2.3 released with fix