Bypass of Client-Certificate Authentication in Sunshine Game Stream Host
CVE-2026-32253

9.8CRITICAL

Key Information:

Vendor

Lizardbyte

Status
Sunshine
Vendor
CVE Published:
22 May 2026

What is CVE-2026-32253?

A vulnerability in the Sunshine game streaming host allows untrusted certificates to bypass client-certificate authentication, compromising access to protected HTTPS endpoints. This issue stems from improper handling of OpenSSL verification results, where specific certificate errors are incorrectly treated as successful verifications. Users are advised to update to version 2026.516.143833 or later to mitigate this risk.

Affected Version(s)

Sunshine < 2026.516.143833

References

https://github.com/LizardByte/Sunshine/security/advisorie...
x_refsource_CONFIRM
https://github.com/LizardByte/Sunshine/releases/tag/v2026...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.