Lizardbyte Sunshine vulnerabilities

• lizardbyte sunshine Disabled Sunshine clients can bypass revocation with a derived client certificate CVE-2026-111044 7.6 HighOctober 16, 2026
• lizardbyte sunshine Sunshine: Authentication bypass via improper client certificate validation CVE-2026-32253 9.8 CriticalMay 22, 2026
• lizardbyte sunshine SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution CVE-2025-54081 6.7 MediumSeptember 23, 2025
• lizardbyte sunshine, sunshine for windows +1 more LizardBytes Sunshine for Windows contains a DLL search-order hijacking vulnerability CVE-2025-10198 7.8 HighSeptember 9, 2025
• lizardbyte sunshine Sunshine application-wide CSRF in the UI leads to command injection as Administrator CVE-2025-53095 9.7 CriticalJuly 1, 2025
• lizardbyte sunshine Sunshine clickjacking in the UI leads to unauthorized actions being performed CVE-2025-53096 5.4 MediumJuly 1, 2025
• lizardbyte sunshine Sunshine improperly enforces pairing protocol request order CVE-2024-51738 7.7 HighJanuary 20, 2025
• lizardbyte sunshine Sunshine has incorrect state management during pairing process may lead to incorrectly authorized client CVE-2024-45407 6.5 MediumSeptember 10, 2024
• lizardbyte sunshine, sunshine for windows +1 more A local privilege escalation vulnerability exists in LizardBytes' Sunshine for Windows CVE-2025-10199 7.8 HighMay 16, 2024
• lizardbyte sunshine Sunshine's unquoted executable path could lead to hijacked execution flow CVE-2024-31226 4.9 MediumMay 16, 2024
• lizardbyte sunshine Clients removed during unpairing process may regain access if Sunshine was not restarted CVE-2024-31221 5.9 MediumApril 8, 2024
• lizardbyte sunshine Sunshine vulnerable to remote unauthenticated arbitrary file read CVE-2024-31220 7.3 HighApril 5, 2024