sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2025-53096 Sunshine clickjacking in the UI leads to unauthorized actions being performed

Medium 5.4 Published Updated

Attackers can trick authenticated users into performing unauthorized actions in the Sunshine web UI via clickjacking, requiring an upgrade to the patched version.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
A user has to click or open something
Fix
None listed

What is CVE-2025-53096?

CVE-2025-53096 is a medium-severity vulnerability in LizardByte Sunshine, published on 1 Jul 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks. This vulnerability allows an attacker to embed the Sunshine interface within a malicious website using an invisible or disguised iframe. If a user is tricked into interacting (one or multiple clicks) with the malicious page while authenticated, they may unknowingly perform actions within the Sunshine application without their consent. This issue has been patched in version 2025.628.4510.

Weakness: CWE-1021

Which versions are affected by CVE-2025-53096?

It affects 1 product.

Products include Lizardbyte Sunshine.

How do I fix CVE-2025-53096?

No fix has been published for CVE-2025-53096 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-53096 being exploited?

There is no known exploitation of CVE-2025-53096 in the wild and no public exploit code.

Sources

Also known as GHSA-x97g-h2vp-g2c5.

Is CVE-2025-53096 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free