EUVD-2026-76152Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessComplete OAuth2 login with own identity
-
DeliveryEdit UID in local config.json to victim's UID
-
ExploitServer skips identity-to-UID binding check
-
ExecutionReceive victim's session tokens
-
ImpactImpersonate user and act on their behalf
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to (1) be able to complete the application's OAuth2 login flow with an identity they control, and (2) manually edit the |
| Impact | The provided CVSS 4.0 vector (9.2, AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) rates this Critical, and the mechanism is genuinely trivial once an attacker can authenticate - editing a plaintext local JSON field. The AT:P (attack requirement) flag correctly signals a precondition: the attacker must complete a legitimate OAuth2 login with an identity they control, and typically must know a target's UID. No EPSS score, KEV entry, or POC weaponization is present in the input; upstream fix code is public but that is distinct from active exploitation, which is not evidenced. The realistic tempering factor is deployment footprint: this is a niche hobbyist FFXIV mod-sync server, so despite the high CVSS the aggregate real-world exposure is small and any exploitation would be targeted rather than widespread. I assess the VA:H (availability) impact as likely overstated - impersonation primarily yields confidentiality and integrity impact over the victim's synced data and pairings, not service outage. |
| Exploit ScenarioDerived | An attacker who can register/authenticate via the OAuth2 provider opens their local config.json and sets the |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 11, 2026
Full user impersonation in the Laci Synchroni sync server (backend prior to 1.2.3) lets an attacker take over any account by editing the client-side UID in their local config.json before login. The server's OAuth2 flow never verified that the authenticated OAuth2 identity actually owned the requested UID, so AuthorizeOauthAsync in SecretKeyAuthenticatorService would issue session tokens for an arbitrary target user. Publicly available fix code exists (PR #28, commit 5bc3efd); no known active exploitation and no EPSS/KEV signal was provided.
RemediationAI
Vendor-released patch: upgrade the server backend to version 1.2.3 or later, which rebinds the UID lookup in AuthorizeOauthAsync (SecretKeyAuthenticatorService) to the authenticated identity via PR #28 (https://github.com/LaciSynchroni/server/pull/28, commit 5bc3efd68b738328b8faeff089dd18a826ec9ca4). The advisory states no known workarounds are available, which is consistent with the flaw being in core server-side identity validation that cannot be safely disabled; operators unable to patch immediately should treat existing sessions as untrusted, and since fix requires server-side deployment, self-hosted instance administrators must update their own deployments rather than relying on clients. Refer to GHSA-gq4p-pxvg-6x9j for details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Laci Synchroni is a decentralized mod-and-appearance synchronization server and Dalamud plugin used in the FFXIV modding ecosystem (CPE cpe:2.3:a:lacisynchroni:server). The root cause is CWE-287 (Improper Authentication): the backend performed authorization based on a client-supplied identifier rather than the server-verified identity. Specifically, the OAuth2 handler looked up the Auth record by the requested UID drawn from the user's local Authentications object without constraining that lookup to the record belonging to the successfully authenticated OAuth2 principal. The patch adds a .Where(auth => auth == authUser) predicate so the token lookup is strictly bound to the verified identity (primaryUid), refusing to return session tokens when the requestedUid does not match the authenticated database record.
Know when Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network OAuth2 endpoint and trivial config edit give AV:N/AC:L; attacker uses own login so PR:N; impersonation yields C:H/I:H, but availability impact is not substantiated so A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to 1.2.3 have an improper authentication vulnerability in the application's OAuth2 login flow. The application relies on client-side state by trusting the UID field inside the Authentications object of a user's local config.json file. By manually editing this local file on their PC prior to logging in, a user can supply an arbitrary UID. Because the server fails to validate that the authenticated OAuth2 identity matches the requested UID, an attacker can fully impersonate any target user and perform actions on their behalf. This issue has been resolved in version 1.2.3. The patch modifies AuthorizeOauthAsync inside the SecretKeyAuthenticatorService to strictly bind the lookup of the requested User ID (requestedUid) to the record of the successfully authenticated identity (primaryUid). The server will no longer load or return session tokens for a requested UID unless it matches the verified, authenticated database record. No known workarounds are available.
Technical POC Analysis
Improper authentication, CWE-287.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Laci Synchroni sync server versions prior to 1.2.3 contain a critical authentication bypass that allows any authenticated user to impersonate other accounts by modifying client configuration during the OAuth2 flow. An attacker with legitimate sync server credentials can gain unauthorized access to any user's account, including administrators, enabling data theft and privilege escalation. Organizations using affected versions must immediately restrict access and deploy patches to prevent account takeover and data breach.
No official vendor-released patch identified at time of analysis. Immediately compile and deploy the publicly available fix code from PR #28 (commit 5bc3efd) to address the AuthorizeOauthAsync vulnerability in SecretKeyAuthenticatorService. Pending patch deployment, restrict sync server network access to internal networks with strict IP allowlisting, implement comprehensive authentication logging with real-time alerts for unusual account access or multiple failed authentication attempts, and require immediate password reset for all user accounts. Monitor OAuth2 session token issuance for anomalies.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injectio
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
JetAudio jetCast Server 2.0 contains a stack-based buffer overflow vulnerability in the Log Directory configuration fiel
Credential-holding attackers can completely bypass TOTP two-factor authentication on Sync-in Server versions prior to 2.
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to sen
An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
Audit log integrity across all Bitwarden Server organizations can be undermined by any authenticated user, who may injec
Exploit-DB