CVE-2026-32253
Sunshine, a self-hosted game streaming host for Moonlight, had a flaw that let attackers bypass client‑certificate authentication. The bug was caused by the OpenSSL verification callback treating certain errors as success, allowing untrusted certificates to access protected HTTPS endpoints. The issue is fixed in version 2026.516.143833.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Sunshine (lizardbyte sunshine) versions prior to 2026.516.143833.
Real-world impact
An attacker could use a forged or expired certificate to authenticate as a legitimate client and gain access to protected HTTPS endpoints, potentially allowing them to control or eavesdrop on the streaming service.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network with no authentication or user interaction, and it compromises confidentiality, integrity, and availability of the protected resources.
What to do about it
- 01Upgrade Sunshine to version 2026.516.143833 or later.
NVD-referenced vendor advisory
Timeline
- May 22, 2026 · May 22, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/LizardByte/Sunshine/release…productrelease notes
- github.com/LizardByte/Sunshine/securit…exploitvendor advisory