Sunshine is a self-hosted game stream host for Moonlight. In versions prior to 2026.516.143833, the client-certificate authentication can be bypassed because of how OpenSSL verification results are handled. In src/crypto.cpp, the custom verify callback treats X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY, X509_V_ERR_CERT_NOT_YET_VALID, and X509_V_ERR_CERT_HAS_EXPIRED as success. This can allow an untrusted certificate to pass authentication and access protected HTTPS endpoints. This issue has been fixed in version 2026.516.143833.
References
| Link | Resource |
|---|---|
| https://github.com/LizardByte/Sunshine/releases/tag/v2026.516.143833 | Product Release Notes |
| https://github.com/LizardByte/Sunshine/security/advisories/GHSA-ph75-mgxh-mv57 | Exploit Vendor Advisory |
| https://github.com/LizardByte/Sunshine/security/advisories/GHSA-ph75-mgxh-mv57 | Exploit Vendor Advisory |
Configurations
History
26 May 2026, 14:43
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Lizardbyte
Lizardbyte sunshine |
|
| CPE | cpe:2.3:a:lizardbyte:sunshine:*:*:*:*:*:*:*:* | |
| References | () https://github.com/LizardByte/Sunshine/releases/tag/v2026.516.143833 - Product, Release Notes | |
| References | () https://github.com/LizardByte/Sunshine/security/advisories/GHSA-ph75-mgxh-mv57 - Exploit, Vendor Advisory |
26 May 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/LizardByte/Sunshine/security/advisories/GHSA-ph75-mgxh-mv57 - |
22 May 2026, 18:28
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-22 17:16
Updated : 2026-05-26 14:43
NVD link : CVE-2026-32253
Mitre link : CVE-2026-32253
CVE.ORG link : CVE-2026-32253
JSON object : View
Products Affected
lizardbyte
- sunshine