Executive brief
Sunshine is a self-hosted game streaming server that allows users to stream games and desktop sessions to other devices. A security flaw in how the server verifies client identities allows unauthorized users to bypass authentication by presenting invalid or expired security certificates. An attacker could exploit this to gain full control over the streaming session, potentially leading to a complete takeover of the host computer.
Technical details
An authentication bypass vulnerability exists in Sunshine's client-certificate validation logic within `src/crypto.cpp`. The custom OpenSSL verification callback (`openssl_verify_cb`) incorrectly handles specific error codes—specifically `X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY`, `X509_V_ERR_CERT_NOT_YET_VALID`, and `X509_V_ERR_CERT_HAS_EXPIRED`—by treating them as successful validation states. Consequently, when `cert_chain_t::verify` is called during the TLS handshake for HTTPS endpoints, it accepts untrusted, expired, or self-signed certificates as valid. A remote, unauthenticated attacker can exploit this to access privileged API endpoints, such as `/applist`, allowing for unauthorized session control and remote input. The issue is resolved in version 2026.516.143833.
Affected products
- LizardByte Sunshine < v2026.516.143833
Timeline
- 2026-05-16: patched: Version 2026.516.143833 released
- 2026-05-21: advisory: GitHub Security Advisory published
- 2026-05-22: disclosed: CVE-2026-32253 published to NVD