Description (CNA)
Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order and is thereby vulnerable to a MITM attack, potentially allowing an unauthenticated attacker to pair a client by hijacking a legitimate pairing attempt. This bug may also be used by a remote attacker to crash Sunshine. This vulnerability is fixed in 2025.118.151840.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| LizardByte / Sunshine | affected < 2025.118.151840 |
CWE
CWE-305, CWE-476, CWE-841
References
- https://github.com/LizardByte/Sunshine/security/advisories/GHSA-3hrw-xv8h-9499
- https://github.com/LizardByte/Sunshine/commit/89f097ae65277d42b5d40163d09d92e412e6d7dd
ADP enrichment
No English description supplied.
No references supplied.