Desynchronization is a state mismatch between a client and a server: the client may display one thing while the server records another. In cyber security, this matters because many modern systems trust both ends to some degree, and any gap between them can be used to confuse validation, bypass rules, or trigger inconsistent decisions. In games, for example, a player may see one position, score, or status while the server has a different authoritative record.
Attackers look for desynchronization when they probe for race conditions, replay issues, or edge cases in state updates. If a system checks a request before state changes are fully confirmed, an action may be accepted twice or rejected incorrectly. Defenders reduce this risk by making the server authoritative, using strong session tracking, validating every state transition, and logging differences between client-reported and server-stored data. Desynchronization is often a reliability bug first, but in security-sensitive systems it can become an abuse path.