All vulnerabilities
CVE-2026-111044GHSA-6jvv-jqr7-m6m3

Disabled Sunshine clients can bypass revocation with a derived client certificate

LizardByte Sunshine
Open in ThreatlineRecord JSON
CVSS
7.6High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published16 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate derived from its paired certificate and bypass the Disable control. Equivalent PEM encodings could also cause inconsistent client identity handling. A client that was never paired cannot use this issue, and removing the paired client removes its trust relationship. This issue is fixed in version 2026.906.222525.

Text from CVE List

Affected versions 2

  • Sunshineaffected: >= 2026.329.165800, < 2026.906.222525CVE List
  • LizardByte/Sunshine, other>= 2026.329.165800GitHub

References 3