CVE-2026-111044

Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate derived from its paired certificate and bypass the Disable control. Equivalent PEM encodings could also cause inconsistent client identity handling. A client that was never paired cannot use this issue, and removing the paired client removes its trust relationship. This issue is fixed in version 2026.906.222525.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/LizardByte/Sunshine/commit/4d768847fcd88cc94ac745c4611715c67d7d67e1
https://github.com/LizardByte/Sunshine/releases/tag/v2026.906.222525
https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6jvv-jqr7-m6m3

Configurations

No configuration.

History

16 Oct 2026, 22:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-16 22:17

Updated : 2026-10-28 16:17

NVD link : CVE-2026-111044

Mitre link : CVE-2026-111044

CVE.ORG link : CVE-2026-111044

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-111044", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-111044", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-28T15:32:43.180883Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "LizardByte", "product": "Sunshine", "versions": [{"status": "affected", "version": ">= 2026.329.165800, < 2026.906.222525"}]}]}], "published": "2026-10-16T22:17:20.610", "references": [{"url": "https://github.com/LizardByte/Sunshine/commit/4d768847fcd88cc94ac745c4611715c67d7d67e1", "source": "security-advisories@github.com"}, {"url": "https://github.com/LizardByte/Sunshine/releases/tag/v2026.906.222525", "source": "security-advisories@github.com"}, {"url": "https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6jvv-jqr7-m6m3", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate derived from its paired certificate and bypass the Disable control. Equivalent PEM encodings could also cause inconsistent client identity handling. A client that was never paired cannot use this issue, and removing the paired client removes its trust relationship. This issue is fixed in version 2026.906.222525."}], "lastModified": "2026-10-28T16:17:00.817", "sourceIdentifier": "security-advisories@github.com"}