Sunshine vulnerabilities

Sunshine from 2026.329.165800 until 2026.906.222525 accepted any client certificate that chained to a stored paired-client certificate, without requiring the presented certificate to be the exact enabled paired identity. Certificate text was compared without canonicalizing equivalent PEM encodings, allowing a previously paired client to bypass the Disable control.

In Sunshine, a self-hosted game stream host for Moonlight, versions prior to 2026.516.143833, client-certificate authentication can be bypassed due to how OpenSSL verification results are handled. The custom verify callback treats some errors as success, allowing untrusted certificates.

The Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222.