CVE-2026-111044 Details
Description
Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate derived from its paired certificate and bypass the Disable control. Equivalent PEM encodings could also cause inconsistent client identity handling. A client that was never paired cannot use this issue, and removing the paired client removes its trust relationship. This issue is fixed in version 2026.906.222525.
A vulnerability in LizardByte Sunshine versions 2026.329.165800 through 2026.906.222525 allows a previously paired client to bypass authorization controls by presenting a derived client certificate. Sunshine's GameStream server accepted any client certificate that chained to a stored paired-client certificate, without requiring an exact match to the enabled paired identity. This flaw, combined with improper handling of equivalent PEM encodings, could lead to inconsistent client identity verification. The issue does not affect clients that were never paired, and revoking a paired client removes its trust relationship.
Users can update to Sunshine version 2026.906.222525 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LizardByte/Sunshine/commit/4d768847fcd88cc94ac745c4611715c67d7d67e1 | [email protected] | Source CodeVendor |
| https://github.com/LizardByte/Sunshine/releases/tag/v2026.906.222525 | [email protected] | Release NotesVendor |
| https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6jvv-jqr7-m6m3 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LizardByte Sunshine | >= 2026.329.165800 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |