CVE-2026-32253: Sunshine: Authentication bypass via improper client certificate validation
Sunshine is a self-hosted game stream host for Moonlight. In versions prior to 2026.516.143833, the client-certificate authentication can be bypassed because of how OpenSSL verification results are handled. In src/crypto.cpp, the custom verify callback treats X509VERRUNABLETOGETISSUERCERTLOCALLY, X509VERRCERTNOTYETVALID, and X509VERRCERTHASEXPIRED as success. This can allow an untrusted certificate to pass authentication and access protected HTTPS endpoints. This issue has been fixed in version 2026.516.143833.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Sunshine (self-hosted game stream host for Moonlight)to a version that resolves this vulnerability.Fixed in 2026.516.143833
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32253?
The severity of CVE-2026-32253 is critical with a score of 9.8.
How do I fix CVE-2026-32253?
To fix CVE-2026-32253, upgrade to Sunshine version 2026.516.143833 or later.
What is the main risk associated with CVE-2026-32253?
The main risk associated with CVE-2026-32253 is an authentication bypass due to improper client certificate validation.
Which versions of Sunshine are affected by CVE-2026-32253?
All versions of Sunshine prior to 2026.516.143833 are affected by CVE-2026-32253.
What impact does CVE-2026-32253 have on data security?
CVE-2026-32253 can lead to unauthorized access, compromising the confidentiality, integrity, and availability of user data.