With the increased radio frequency identification (RFID) applications different authentication schemes have been proposed in order to meet the required properties. In this paper we analyze the security of a server-less RFID authentication protocol which is proposed by Deng et al. in 2014. Deng et al. proposed an improvement over Hoque et al. protocol to overcome its vulnerability against data desynchronization attack. However, in this paper we show that their protocol is still vulnerable against data desynchronization attack. Furthermore we present an improved version of this protocol to prevent this attack.