CVE-2026-32253 Sunshine: Authentication bypass via improper client certificate validation

Critical 9.8 Published 22 May 2026 Updated 26 May 2026

Attackers can bypass client certificate authentication in Sunshine to access protected endpoints due to improper OpenSSL verification handling.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-32253?

CVE-2026-32253 is a critical authentication bypass vulnerability in LizardByte Sunshine, published on 22 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Sunshine is a self-hosted game stream host for Moonlight. In versions prior to 2026.516.143833, the client-certificate authentication can be bypassed because of how OpenSSL verification results are handled. In src/crypto.cpp, the custom verify callback treats X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY, X509_V_ERR_CERT_NOT_YET_VALID, and X509_V_ERR_CERT_HAS_EXPIRED as success. This can allow an untrusted certificate to pass authentication and access protected HTTPS endpoints. This issue has been fixed in version 2026.516.143833.

Weakness: CWE-295, CWE-287

Which versions are affected by CVE-2026-32253?

It affects 1 product.

Products include Lizardbyte Sunshine.

How do I fix CVE-2026-32253?

No fix has been published for CVE-2026-32253 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-32253 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32253 exists.

Sources

Also known as GHSA-ph75-mgxh-mv57.