TI-2026-24782 CVE-2026-32253
Sunshine: Authentication bypass via improper client certificate validation
Priority HIGH 82
Sunshine is a self-hosted game stream host for Moonlight.
LizardByte
Records12All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9
Exploited now
LizardByte records in CISA KEVNo LizardByte vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
12 records
TI-2025-33924 CVE-2025-54081
SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution
Priority HIGH 66
Sunshine is a self-hosted game stream host for Moonlight.
TI-2025-33088 CVE-2025-53095
Sunshine application-wide CSRF in the UI leads to command injection as Administrator
Priority MEDIUM 42
Sunshine is a self-hosted game stream host for Moonlight.
Priority LOW 37
Sunshine is a self-hosted game stream host for Moonlight.
TI-2025-09364 CVE-2025-10199 · GHSA-7fx4-846p-mpq2
A local privilege escalation vulnerability exists in LizardBytes' Sunshine for Windows
Priority LOW 35
A local privilege escalation vulnerability exists in Sunshine for Windows (version v2025.122.141614 and likely prior versions) due to an unquoted service path.
TI-2025-09363 CVE-2025-10198 · GHSA-m9hx-h78h-jqvc
LizardBytes Sunshine for Windows contains a DLL search-order hijacking vulnerability
Priority LOW 35
Sunshine for Windows, version v2025.122.141614, contains a DLL search-order hijacking vulnerability, allowing attackers to insert a malicious DLL in user-writeable PATH directories.
Priority LOW 33
Sunshine is a self-hosted game stream host for Moonlight.
Priority LOW 32
Sunshine is a self-hosted game stream host for Moonlight.
TI-2024-30456 CVE-2024-45407
Sunshine has incorrect state management during pairing process may lead to incorrectly authorized client
Priority LOW 29
Sunshine is a self-hosted game stream host for Moonlight.
TI-2025-33089 CVE-2025-53096
Sunshine clickjacking in the UI leads to unauthorized actions being performed
Priority LOW 27
Sunshine is a self-hosted game stream host for Moonlight.
TI-2024-20598 CVE-2024-31221
Clients removed during unpairing process may regain access if Sunshine was not restarted
Priority LOW 27
Sunshine is a self-hosted game stream host for Moonlight.
TI-2024-20602 CVE-2024-31226
Sunshine's unquoted executable path could lead to hijacked execution flow
Priority LOW 24
Sunshine is a self-hosted game stream host for Moonlight.