Self-Hosted Game Stream Host Sunshine Affected by Client Certificate Validation Issue
CVE-2026-111044

7.6HIGH

Key Information:

Vendor

Lizardbyte

Status
Sunshine
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111044?

Sunshine, a self-hosted game streaming application, was discovered to accept any client certificate that could chain to a stored paired-client certificate, bypassing the requirement for exact identity matching. This flaw stemmed from improper handling of certificate comparisons without standardization of PEM encodings, potentially allowing previously paired clients to present altered certificates derived from their originals. An unpaired client cannot exploit this vulnerability, and trust relationships can be severed by removing paired clients. The issue was rectified in version 2026.906.222525.

Affected Version(s)

Sunshine >= 2026.329.165800, < 2026.906.222525

References

https://github.com/LizardByte/Sunshine/security/advisorie...
x_refsource_CONFIRM
https://github.com/LizardByte/Sunshine/commit/4d768847fcd...
x_refsource_MISC
https://github.com/LizardByte/Sunshine/releases/tag/v2026...
x_refsource_MISC

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.