LizardByte Sunshine vulnerabilities

Latest LizardByte Sunshine CVEs

Newest publication first

1. CVE-2026-111044 Disabled Sunshine clients can bypass revocation with a derived client certificate

   Published 2026-10-16

   High·CVSS 7.6 EPSS 0.16%

   Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired ident...

2. CVE-2026-32253 Sunshine: Authentication bypass via improper client certificate validation

   Published 2026-05-22

   Critical·CVSS 9.8 EPSS 0.29%

   Sunshine is a self-hosted game stream host for Moonlight. In versions prior to 2026.516.143833, the client-certificate authentication can be bypassed because of how OpenSSL verification results are handled. In src/crypto.cpp, the custom verify callback treats X509_V_ERR_UNABLE_TO...

3. CVE-2025-54081 SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution

   Published 2025-09-23

   High·CVSS 7.0 EPSS 0.23%

   Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) int...

4. CVE-2025-10199 A local privilege escalation vulnerability exists in LizardBytes' Sunshine for Windows

   Published 2025-09-09

   High·CVSS 7.8 EPSS 0.19%

   A local privilege escalation vulnerability exists in Sunshine for Windows (version v2025.122.141614 and likely prior versions) due to an unquoted service path.

5. CVE-2025-10198 LizardBytes Sunshine for Windows contains a DLL search-order hijacking vulnerability

   Published 2025-09-09

   High·CVSS 7.8 EPSS 0.22%

   Sunshine for Windows, version v2025.122.141614, contains a DLL search-order hijacking vulnerability, allowing attackers to insert a malicious DLL in user-writeable PATH directories.

6. CVE-2025-53095 Sunshine application-wide CSRF in the UI leads to command injection as Administrator

   Published 2025-07-01

   High·CVSS 8.8 EPSS 0.24%

   Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Cross-Site Request Forgery (CSRF) attacks. This vulnerability allows an attacker to craft a malicious web page that, when visited by an authen...

7. CVE-2025-53096 Sunshine clickjacking in the UI leads to unauthorized actions being performed

   Published 2025-07-01

   Medium·CVSS 6.1 EPSS 0.24%

   Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks. This vulnerability allows an attacker to embed the Sunshine interface within a malicious website using an invisible or d...

8. CVE-2024-51738 Sunshine improperly enforces pairing protocol request order

   Published 2025-01-20

   High·CVSS 7.7 EPSS 0.60%

   Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order and is thereby vulnerable to a MITM attack, potentially allowing an unauthenticated attacker to pair a client by hijacking a...

9. CVE-2024-45407 Sunshine has incorrect state management during pairing process may lead to incorrectly authorized client

   Published 2024-09-10

   Medium·CVSS 5.3 EPSS 0.35%

   Sunshine is a self-hosted game stream host for Moonlight. Clients that experience a MITM attack during the pairing process may inadvertantly allow access to an unintended client rather than failing authentication due to a PIN validation error. The pairing attempt fails due to the...

10. CVE-2024-31226 Sunshine's unquoted executable path could lead to hijacked execution flow

    Published 2024-05-16

    Low·CVSS 2.9 EPSS 0.22%

    Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when terminating the service if an attacked placed a file named C:\Program.exe, C:\Program.bat, or C:\Program.cmd on the user's...

11. CVE-2024-31221 Clients removed during unpairing process may regain access if Sunshine was not restarted

    Published 2024-04-08

    Medium·CVSS 5.9 EPSS 0.51%

    Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all devices in the web UI interface and then pairing only one device, all of the previously devices will be temporarily paired. Version 0.23.0 contain...

12. CVE-2024-31220 Sunshine vulnerable to remote unauthenticated arbitrary file read

    Published 2024-04-05

    High·CVSS 7.3 EPSS 0.49%

    Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.16.0 and prior to version 0.18.0, an attacker may be able to remotely read arbitrary files without authentication due to a path traversal vulnerability. Users who exposed the Sunshine configuration we...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.