Clients removed during unpairing process may regain access if Sunshine was not restarted
Priority LOW 27CWE-384Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-384.
Summary
Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all devices in the web UI interface and then pairing only one device, all of the previously devices will be temporarily paired. Version 0.23.0 contains a patch for the issue. As a workaround, restarting Sunshine after unpairing all devices prevents the vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00509 43rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Sunshine (LizardByte): 0.23.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| LizardByte | Sunshine | 0.10.0 to before 0.23.0 | 0.23.0 | Patch available | CNA |
- Sunshine VendorLizardByte Affected 0.10.0 to before 0.23.0 Fixed in 0.23.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:lizardbyte:sunshine:*:*:*:*:*:*:*:* | 0.10.0 to before 0.23.0 | Vulnerable | LizardByte |
- cpe:2.3:a:lizardbyte:sunshine:*:*:*:*:*:*:*:* Versions 0.10.0 to before 0.23.0 Vulnerable ·LizardByte
Remediation
- Fix · CNA Sunshine (LizardByte) Fixed in 0.23.0
Timeline
- 2026-10-02 Threatist record created from CVE-2024-31221
References
More LizardByte Sunshine vulnerabilities
- TI-2026-24782 Sunshine: Authentication bypass via improper client certificate validation CVSS 3.1CRITICAL 9.8
- TI-2025-33924 SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution CVSS 3.1HIGH 7.0
- TI-2025-33088 Sunshine application-wide CSRF in the UI leads to command injection as Administrator CVSS 3.1CRITICAL 9.7
- TI-2024-34644 Sunshine improperly enforces pairing protocol request order CVSS 4.0HIGH 7.7
- TI-2025-09364 A local privilege escalation vulnerability exists in LizardBytes' Sunshine for Windows CVSS 3.1HIGH 7.8
- TI-2025-09363 LizardBytes Sunshine for Windows contains a DLL search-order hijacking vulnerability CVSS 3.1HIGH 7.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences