CVE-2026-32253 — Sunshine (self-hosted game streaming server)

Key facts

CVE-2026-32253 (LizardByte) is a Critical (9.8) vulnerability: Sunshine (self-hosted game streaming server). This entry ships ready-to-deploy detection and prevention rules (Snort) plus a detection-only PoC and a Docker test lab.

CVE	CVE-2026-32253
Severity	Critical (9.8)
Vendor	LizardByte
Product	Sunshine (self-hosted game streaming server)
Detection / prevention	Snort
PoC	poc.py
Source	2026/CVE-2026-32253/

Details

CVE-2026-32253 (LizardByte) is a Critical (9.8) vulnerability: Sunshine (self-hosted game streaming server). This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort) — see Detection and prevention below. Source: NVD record.

Overview

Field	Value
CVE	CVE-2026-32253
CVSS	9.8 (Critical)
Vendor	LizardByte
Product	Sunshine (self-hosted game streaming server)
Affected	Sunshine <= 2026.516.143833
Fixed	Upgrade to Sunshine > 2026.516.143833

Root Cause

Sunshine's TLS client certificate authentication implementation in src/crypto.cpp contains an incorrect OpenSSL verify callback. When a client presents a certificate during the TLS handshake, OpenSSL invokes the application-supplied verify callback with a preverify_ok parameter indicating whether the certificate passed chain validation. The Sunshine callback incorrectly handles the case where preverify_ok is 0 (validation failure) — instead of propagating the failure and terminating the handshake, the callback returns 1 (success) under certain error code conditions, effectively instructing OpenSSL to accept the invalid or absent certificate and complete the handshake. This means the authentication gate that should reject unenrolled Moonlight clients is silently bypassed.

Problem

An unauthenticated remote attacker on the network can connect to a Sunshine game streaming server without possessing a valid paired client certificate:

• Authentication bypass: Connect to the Sunshine HTTPS management interface and streaming endpoints without completing the Moonlight pairing process.
• Unauthorized game streaming access: Gain full control of the host machine's display, keyboard, and mouse through the remote desktop streaming session.
• Management API access: Access the Sunshine web UI (default port 47990) to modify configuration, add/remove paired clients, change credentials, and access system settings.
• Lateral movement: Use the streaming session's input control to execute arbitrary actions on the host operating system with the privileges of the Sunshine service user.
• Privacy violation: View and record the host screen in real time without the owner's knowledge.

Detection

Run the proof-of-concept to test whether your Sunshine instance is vulnerable:

python poc.py --host <sunshine-host> --port 47990

The PoC attempts a TLS connection to the Sunshine management port without presenting any client certificate (or with a self-signed certificate not enrolled via pairing). A vulnerable instance completes the TLS handshake and returns an HTTP response from the management interface rather than closing the connection with a TLS alert.

Manual test:

curl -k --cert /dev/null https://<sunshine-host>:47990/api/apps
# Vulnerable: returns JSON response
# Patched: TLS handshake failure or 401/403

Check Sunshine version:

sunshine --version
# Vulnerable if version string date <= 2026.516.143833

Remediation

1. Upgrade Sunshine: Download and install the latest Sunshine release (> 2026.516.143833) from the official LizardByte repository. The fix corrects the OpenSSL verify callback in src/crypto.cpp to properly return 0 when preverify_ok is 0.
2. Restrict network access: As an immediate mitigation, configure host firewall rules to limit access to Sunshine ports (47984, 47989, 47990, 48010) to trusted IP addresses only.
3. Disable remote management UI: If the web UI is not needed, disable it in sunshine.conf by setting upnp = disabled and binding only to localhost.
4. Monitor connection logs: Review Sunshine logs for unexpected client connection attempts from unpaired IP addresses that completed TLS handshakes.
5. Rotate pairing credentials: After upgrading, unpair all existing clients and re-pair them to ensure only legitimately enrolled clients hold valid certificates.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-32253
• LizardByte Sunshine GitHub: https://github.com/LizardByte/Sunshine
• OpenSSL SSL_CTX_set_verify documentation: https://www.openssl.org/docs/man3.0/man3/SSL_CTX_set_verify.html

Detection and prevention

Ready-to-deploy defensive rules for CVE-2026-32253, for authorized testing and blue-team detection engineering:

• Snort IDS signature — prevention/snort.rules
• Detection-only PoC — poc.py
• Rule notes — prevention/README.md

References: NVD — CVE-2026-32253 · full write-up on the searchable site

Detection & prevention rules

Snort IDS signature

alert tcp $EXTERNAL_NET any -> $HOME_NET 47990 (msg:"CVE-2026-32253 Sunshine streaming unauthenticated API endpoint access"; flow:to_server,established; pcre:"/\/api\/(?:apps|config|pin|clients|password|restart|quit|unpair)/i"; http_uri; classtype:attempted-recon; sid:9002706; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 47990 (msg:"CVE-2026-32253 Sunshine auth bypass POST to sensitive management API"; flow:to_server,established; content:"POST"; http_method; pcre:"/\/api\/(?:apps|config|pin|password|unpair|clients)/i"; http_uri; classtype:web-application-attack; sid:9002707; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 47990 (msg:"CVE-2026-32253 Sunshine service rapid endpoint enumeration"; flow:to_server,established; pcre:"/\/(?:api|serverinfo|appasset)\//i"; http_uri; threshold:type threshold,track by_src,count 5,seconds 30; classtype:attempted-recon; sid:9002708; rev:1;)

:material-file-download: prevention/snort.rules

Frequently asked questions

What is CVE-2026-32253?

CVE-2026-32253 (LizardByte) is a Critical (9.8) vulnerability: Sunshine (self-hosted game streaming server). This entry ships ready-to-deploy detection and prevention rules (Snort) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-32253?

Deploy the Snort detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-32253?

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

---

For authorized security testing and research only. See the full source and NVD record.