TI-2026-76067 Aliases CVE-2026-111044

Sunshine lets disabled paired clients bypass the Disable control

LOW 32CWE-863Published 2026-10-16 · Updated 2026-10-28

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

LizardByte Sunshine, a self-hosted game stream host for Moonlight, from 2026.329.165800 before 2026.906.222525 accepts any client certificate that chains to a stored paired-client certificate. The check does not require the presented certificate to be the exact enabled paired identity (CWE-863). A previously paired client that keeps its private key can present a derived certificate to bypass the Disable control, while a client that was never paired cannot use this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate derived from its paired certificate and bypass the Disable control. Equivalent PEM encodings could also cause inconsistent client identity handling. A client that was never paired cannot use this issue, and removing the paired client removes its trust relationship. This issue is fixed in version 2026.906.222525.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00158 4th percentileScored 2026-11-07

Fix Fixed Sunshine (LizardByte): 2026.906.222525

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
LizardByte	Sunshine	2026.329.165800 to before 2026.906.222525	2026.906.222525	Patch available	CNA

Sunshine VendorLizardByte Affected 2026.329.165800 to before 2026.906.222525 Fixed in 2026.906.222525 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:lizardbyte:sunshine::::::::	—	—	LizardByte

cpe:2.3:a:lizardbyte:sunshine:*:*:*:*:*:*:*:* Versions — — ·LizardByte

Remediation

Upgrade Sunshine to version 2026.906.222525, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA Sunshine (LizardByte) Fixed in 2026.906.222525

Timeline

2026-10-18 Threatist record created from CVE-2026-111044
2026-10-18 Priority changed: MEDIUM → LOW
2026-10-28 CISA SSVC decision points changed

References

Other 3

TI-2026-24782 Sunshine: Authentication bypass via improper client certificate validation CVSS 3.1CRITICAL 9.8
TI-2025-33924 SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution CVSS 3.1HIGH 7.0
TI-2025-33088 Sunshine application-wide CSRF in the UI leads to command injection as Administrator CVSS 3.1CRITICAL 9.7
TI-2024-34644 Sunshine improperly enforces pairing protocol request order CVSS 4.0HIGH 7.7
TI-2025-09364 A local privilege escalation vulnerability exists in LizardBytes' Sunshine for Windows CVSS 3.1HIGH 7.8
TI-2025-09363 LizardBytes Sunshine for Windows contains a DLL search-order hijacking vulnerability CVSS 3.1HIGH 7.8

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences