CVE-2026-111044
7.6HighPublished 16 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-863
Impact
A previously paired client can bypass the Disable control and regain unauthorized access to the stream host. The attacker needs network access and must already hold the private key from a valid prior pairing.
Root cause
Sunshine accepted any client certificate chaining to a stored paired certificate without enforcing exact identity matches or canonicalizing PEM encodings.
Affected systems
Sunshine 2026.329.165800 up to (excluding) 2026.906.222525
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Fix & remediation
Upgrade Sunshine to version 2026.906.222525 or later. If patching immediately is not possible, completely remove (unpair) the client instead of merely disabling it.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate derived from its paired certificate and bypass the Disable control. Equivalent PEM encodings could also cause inconsistent client identity handling. A client that was never paired cannot use this issue, and removing the paired client removes its trust relationship. This issue is fixed in version 2026.906.222525.