CVE-2026-111044: Disabled Sunshine clients can bypass revocation with a derived client certificate
Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate derived from its paired certificate and bypass the Disable control. Equivalent PEM encodings could also cause inconsistent client identity handling. A client that was never paired cannot use this issue, and removing the paired client removes its trust relationship. This issue is fixed in version 2026.906.222525.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Sunshineto a version that resolves this vulnerability.Fixed in 2026.906.222525
Event History
Frequently Asked Questions
Which deployments are exposed?
Sunshine versions from 2026.329.165800 up to, but not including, 2026.906.222525 are affected. Exposure requires a client that was previously paired and still possesses its private key; a client that was never paired cannot exploit this issue.
Does disabling a paired client revoke its access?
Not reliably on affected versions. A disabled client can bypass the Disable control by presenting an alternate certificate derived from its stored paired-client certificate.
What can be done before upgrading?
Remove the paired client rather than only disabling it. Removing the paired client removes its trust relationship.
How can I determine whether a disabled client may still be able to connect?
Identify clients that were paired before being disabled and may still retain their private keys. Those clients can potentially use a derived certificate or an equivalent PEM encoding to bypass disabled-client handling on affected versions.
What version fixes the issue?
The issue is fixed in Sunshine version 2026.906.222525.