CVE-2026-32253: critical vulnerability in LizardByte Sunshine
Sunshine: Authentication bypass via improper client certificate validation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 0.3%
Sunshine is a self-hosted game stream host for Moonlight. In versions prior to 2026.516.143833, the client-certificate authentication can be bypassed because of how OpenSSL verification results are handled. In src/crypto.cpp, the custom verify callback treats X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY, X509_V_ERR_CERT_NOT_YET_VALID, and X509_V_ERR_CERT_HAS_EXPIRED as success. This can allow an untrusted certificate to pass authentication and access protected HTTPS endpoints. This issue has been fixed in version 2026.516.143833.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
LizardByte · SunshineRelated CVEs — LizardByte Sunshine
In the same product, most dangerous first.
CVE-2024-51738HIGHSunshine improperly enforces pairing protocol request orderEPSS 0.6%CVE-2024-31221MEDIUMClients removed during unpairing process may regain access if Sunshine was not restartedEPSS 0.5%CVE-2024-31220HIGHSunshine vulnerable to remote unauthenticated arbitrary file readEPSS 0.5%CVE-2024-45407MEDIUMSunshine has incorrect state management during pairing process may lead to incorrectly authorized clientEPSS 0.3%CVE-2025-53096MEDIUMSunshine clickjacking in the UI leads to unauthorized actions being performedEPSS 0.2%CVE-2025-53095CRITICALSunshine application-wide CSRF in the UI leads to command injection as AdministratorEPSS 0.2%