LizardByte Sunshine vulnerabilities

CVEs per yearBy the year they were published

1. 20244
2. 20254
3. 20262

Newest CVEs

• CVE-2026-111044

  Disabled Sunshine clients can bypass revocation with a derived client certificate

  LizardByte · Sunshine

  High7.6
• CVE-2026-32253

  Sunshine: Authentication bypass via improper client certificate validation

  LizardByte · Sunshine

  Critical9.8
• CVE-2025-54081

  SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution

  LizardByte · Sunshine

  Medium6.7
• CVE-2025-53095

  Sunshine application-wide CSRF in the UI leads to command injection as Administrator

  LizardByte · Sunshine

  Critical9.7
• CVE-2025-53096

  Sunshine clickjacking in the UI leads to unauthorized actions being performed

  LizardByte · Sunshine

  Medium5.4
• CVE-2024-51738

  Sunshine improperly enforces pairing protocol request order

  LizardByte · Sunshine

  High7.7
• CVE-2024-45407

  Sunshine has incorrect state management during pairing process may lead to incorrectly authorized client

  LizardByte · Sunshine

  Medium6.5
• CVE-2024-31226

  Sunshine's unquoted executable path could lead to hijacked execution flow

  LizardByte · Sunshine

  Medium4.9
• CVE-2024-31221

  Clients removed during unpairing process may regain access if Sunshine was not restarted

  LizardByte · Sunshine

  Medium5.9
• CVE-2024-31220

  Sunshine vulnerable to remote unauthenticated arbitrary file read

  LizardByte · Sunshine

  High7.3