A critical authentication bypass in LaciSynchroni server allows remote attackers to fully impersonate any user, posing a severe risk to account integrity and data privacy.

The vulnerability stems from improper authentication handling within the OAuth2 flow, where the server incorrectly trusts a user-supplied UID field from a local configuration file. By modifying this file, an unauthenticated attacker can force the server to authenticate them as any arbitrary user identity.

The ability to impersonate any user on the platform grants an attacker full access to the victim's account and associated data. Given the CVSS score of 9.2, this vulnerability represents a critical threat that could lead to unauthorized data access, account takeover, and complete loss of trust in the synchronization service.

Immediate Action: Update the LaciSynchroni server software to version 1.2.3 or higher immediately to apply the necessary server-side validation logic.

Proactive Monitoring: Review server access logs for anomalous login patterns or multiple successful authentications associated with unusual or high-privileged User IDs.

Compensating Controls: As no workarounds are available, prioritize the software update; ensure that the server environment is isolated from public access until the patch is applied.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability is critical due to its potential for total account compromise via trivial configuration manipulation. Administrators must prioritize the upgrade to version 1.2.3 as the sole method to ensure that the server correctly binds identity verification to authenticated database records. Failure to patch leaves the entire user base susceptible to full account impersonation.