Approved changes feed: RSS · Atom
cpe:2.3:a:lizardbyte:sunshine:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Lizardbyte (02480688-956b-50cc-ba10-ed713307f00b) |
|---|---|
| Product | Sunshine (bee715c3-2613-5577-80fc-233e1df70164) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/lizardbyte/sunshine |
purl2cpe | 2026-06-01 10:13:17.678663 |
pkg:rpm/opensuse/sunshine |
purl2cpe | 2026-06-01 10:13:17.678665 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-32253 |
vulnerable | 2026-06-08 07:57:17.312311 |
Sunshine: Authentication bypass via improper client certificate validation
CRITICAL (9.8)
Sunshine is a self-hosted game stream host for Moonlight. In versions prior to 2026.516.143833, the client-certificate authentication can be bypassed because of how OpenSSL verification results are handled. In src/crypto.cpp, the custom verify callback treats X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY, X509_V_ERR_CERT_NOT_YET_VALID, and X509_V_ERR_CERT_HAS_EXPIRED as success. This can allow an untrusted certificate to pass authentication and access protected HTTPS endpoints. This issue has been fixed in version 2026.516.143833.
Published: 2026-05-22T17:07:04.619Z
Updated: 2026-05-26T13:08:19.472Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-54081 |
vulnerable | 2026-06-08 07:33:11.127346 |
SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution
MEDIUM (6.7)
Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222.
Published: 2025-09-23T18:18:39.474Z
Updated: 2025-09-23T19:17:53.733Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-53096 |
vulnerable | 2026-06-08 07:31:13.934835 |
Sunshine clickjacking in the UI leads to unauthorized actions being performed
MEDIUM (5.4)
Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks. This vulnerability allows an attacker to embed the Sunshine interface within a malicious website using an invisible or disguised iframe. If a user is tricked into interacting (one or multiple clicks) with the malicious page while authenticated, they may unknowingly perform actions within the Sunshine application without their consent. This issue has been patched in version 2025.628.4510.
Published: 2025-07-01T01:33:01.336Z
Updated: 2025-07-01T13:21:41.271Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-53095 |
vulnerable | 2026-06-08 07:31:13.934497 |
Sunshine application-wide CSRF in the UI leads to command injection as Administrator
CRITICAL (9.7)
Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Cross-Site Request Forgery (CSRF) attacks. This vulnerability allows an attacker to craft a malicious web page that, when visited by an authenticated user, can trigger unintended actions within the Sunshine application on behalf of that user. Specifically, since the application does OS command execution by design, this issue can be exploited to abuse the "Command Preparations" feature, enabling an attacker to inject arbitrary commands that will be executed with Administrator privileges when an application is launched. This issue has been patched in version 2025.628.4510.
Published: 2025-07-01T01:33:22.331Z
Updated: 2025-07-01T13:21:15.143Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-51738 |
vulnerable | 2026-06-08 06:52:12.755041 |
Sunshine improperly enforces pairing protocol request order
Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order and is thereby vulnerable to a MITM attack, potentially allowing an unauthenticated attacker to pair a client by hijacking a legitimate pairing attempt. This bug may also be used by a remote attacker to crash Sunshine. This vulnerability is fixed in 2025.118.151840.
Published: 2025-01-20T15:26:03.955Z
Updated: 2025-01-21T14:59:35.704Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-45407 |
vulnerable | 2026-06-08 06:48:06.081123 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31226 |
vulnerable | 2026-06-08 06:35:31.128531 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31221 |
vulnerable | 2026-06-08 06:35:31.122220 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31220 |
vulnerable | 2026-06-08 06:35:31.121798 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.