CVE-2024-31221 Clients removed during unpairing process may regain access if Sunshine was not restarted

What is CVE-2024-31221?

CVE-2024-31221 is a medium-severity authentication bypass vulnerability in LizardByte Sunshine, published on 8 Apr 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all devices in the web UI interface and then pairing only one device, all of the previously devices will be temporarily paired. Version 0.23.0 contains a patch for the issue. As a workaround, restarting Sunshine after unpairing all devices prevents the vulnerability.

Weakness: CWE-384

Which versions are affected by CVE-2024-31221?

It affects 1 product.

Products include Lizardbyte Sunshine.

How do I fix CVE-2024-31221?

No fix has been published for CVE-2024-31221 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-31221 being exploited?

There is no known exploitation of CVE-2024-31221 in the wild and no public exploit code.

Other vulnerabilities in LizardByte Sunshine

• CVE-2026-32253 Sunshine: Authentication bypass via improper client certificate validation Critical 9.8
• CVE-2025-53095 Sunshine application-wide CSRF in the UI leads to command injection as Administrator Critical 9.7
• CVE-2025-10198 LizardBytes Sunshine for Windows contains a DLL search-order hijacking vulnerability High 7.8
• CVE-2025-10199 A local privilege escalation vulnerability exists in LizardBytes' Sunshine for Windows High 7.8
• CVE-2024-51738 Sunshine improperly enforces pairing protocol request order High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v8gw-jw28-v55m.