CVE-2026-32253: LizardByte Sunshine, заобикаляне на вход и права

Описание

Оригинално описание

Sunshine is a self-hosted game stream host for Moonlight. In versions prior to 2026.516.143833, the client-certificate authentication can be bypassed because of how OpenSSL verification results are handled. In src/crypto.cpp, the custom verify callback treats X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY, X509_V_ERR_CERT_NOT_YET_VALID, and X509_V_ERR_CERT_HAS_EXPIRED as success. This can allow an untrusted certificate to pass authentication and access protected HTTPS endpoints. This issue has been fixed in version 2026.516.143833.

Засегнати продукти

• LizardByte Sunshine: < 2026.516.143833

Вид слабост

• CWE-287 Неправилна автентикация
• CWE-295 Неправилна валидация на сертификат

История

Други уязвимости в LizardByte Sunshine

• 7.6CVE-2026-111044
• 6.7CVE-2025-54081
• 9.7CVE-2025-53095
• 5.4CVE-2025-53096
• 7.7CVE-2024-51738

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-32253
• https://nvd.nist.gov/vuln/detail/CVE-2026-32253
• https://github.com/LizardByte/Sunshine/security/advisories/GHSA-ph75-mgxh-mv57
• https://github.com/LizardByte/Sunshine/releases/tag/v2026.516.143833