Improper Authentication Vulnerability in Laci Synchroni Plugin by Laci Synchroni

CVE-2026-54047

What is CVE-2026-54047?

The Laci Synchroni plugin is affected by an improper authentication vulnerability that stems from its OAuth2 login flow. The plugin incorrectly trusts client-side state by relying on the UID field within the user’s local config.json file. This allows a motivated attacker to manipulate this local configuration to submit an arbitrary UID, thereby impersonating other users without authorization. The server fails to verify that the authenticated identity from OAuth2 corresponds with the intended UID, thus enabling unauthorized actions. The issue was addressed in version 1.2.3 by modifying the AuthorizeOauthAsync function to ensure only authenticated identities that match the requested UID can obtain session tokens. This fix mitigates risks associated with user impersonation, ensuring robust verification against unauthorized access.

References