Skip to content
OpenAdvisories

Vendor

LizardByte

12 known vulnerabilities.

Products

Sunshine 10 Sunshine for Windows 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-32253

    Sunshine: Authentication bypass via improper client certificate validation

    Sunshine is a self-hosted game stream host for Moonlight. In versions prior to 2026.516.143833, the client-certificate authentication can be bypassed because of how OpenSSL verification results are handled. In src/crypto.cpp, the custom verify callback treats…

    LizardByte Sunshine
  • Critical 9.7
    CVE-2025-53095

    Sunshine application-wide CSRF in the UI leads to command injection as Administrator

    Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Cross-Site Request Forgery (CSRF) attacks. This vulnerability allows an attacker to craft a malicious web page that, when…

    LizardByte Sunshine