CVE-2025-53096: Sunshine clickjacking in the UI leads to unauthorized actions being performed
Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks. This vulnerability allows an attacker to embed the Sunshine interface within a malicious website using an invisible or disguised iframe. If a user is tricked into interacting (one or multiple clicks) with the malicious page while authenticated, they may unknowingly perform actions within the Sunshine application without their consent. This issue has been patched in version 2025.628.4510.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53096?
The severity of CVE-2025-53096 is considered moderate due to the potential for Clickjacking attacks.
How do I fix CVE-2025-53096?
To fix CVE-2025-53096, upgrade to Sunshine version 2025.628.4510 or later.
What type of attack does CVE-2025-53096 enable?
CVE-2025-53096 enables Clickjacking attacks which can lead to unauthorized user actions.
Which versions of Sunshine are affected by CVE-2025-53096?
Sunshine versions prior to 2025.628.4510 are affected by CVE-2025-53096.
What is Clickjacking as related to CVE-2025-53096?
Clickjacking is an attack that tricks users into clicking on something different than what they perceive, potentially compromising their interaction with the Sunshine web UI.