Lizardbyte Sunshine vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Lizardbyte Sunshine: 2 record(s), with affected versions and fixes.cpe:2.3:a:lizardbyte:sunshine
CVE-2026-32253
Critical · 9.8
CWE-287 May 22, 2026
Sunshine: Authentication bypass via improper client certificate validation
Sunshine is a self-hosted game stream host for Moonlight. In versions prior to 2026.516.143833, the client-certificate authentication can be bypassed because of how OpenSSL verification results are handled. In src/crypto.cpp, the custom verify callback treats X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY, X509_V_ERR_CERT_NOT_YET_VALID, and X509_V_ERR_CERT_HAS_EXPIRED as success. This can allow an untrusted certificate to pass authentication and access protected HTTPS endpoints. This issue has been fixed in version 2026.516.143833.
CVE-2025-54081
High · 7.0
CWE-428 Sep 23, 2025
SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution
Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222.