{"id":"CVE-2026-111044","kind":"vulnerability","aliases":["CVE-2026-111044"],"related":[],"title":"Sunshine: paired client can bypass disable control with alternate certificate","description":"Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate derived from its paired certificate and bypass the Disable control. Equivalent PEM encodings could also cause inconsistent client identity handling. A client that was never paired cannot use this issue, and removing the paired client removes its trust relationship. This issue is fixed in version 2026.906.222525.","summary":"Sunshine, a self-hosted game stream host for Moonlight, accepted any client certificate chaining to a stored paired certificate instead of requiring the exact enabled identity. A previously paired client holding its private key can present a derived certificate to bypass the Disable control and keep streaming access.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["game-streaming","moonlight","package","self-hosted","sunshine"],"not_affected_if":["fixed-version","never-paired-clients"],"how_to_check":"- Check the installed Sunshine version against `2026.906.222525`; versions from `2026.329.165800` up to but not including `2026.906.222525` are affected.\n- Review the paired clients list in the Sunshine web UI for clients that were disabled but should no longer have access.","fix":"- Upgrade Sunshine to `2026.906.222525` or later.\n- Remove any paired clients that should no longer have access, since removing a paired client removes its trust relationship.","status":"open","published_at":"2026-10-16T22:17:20+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:14:40+00:00","updated_at":"2026-10-25T03:14:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:14:40Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Sunshine to `2026.906.222525` or later.\n- Remove any paired clients that should no longer have access, since removing a paired client removes its trust relationship.","reach":"network","title":"Sunshine: paired client can bypass disable control with alternate certificate","impact":"low","summary":"Sunshine, a self-hosted game stream host for Moonlight, accepted any client certificate chaining to a stored paired certificate instead of requiring the exact enabled identity. A previously paired client holding its private key can present a derived certificate to bypass the Disable control and keep streaming access.","category":"package","nicknames":[],"who_cares":["self-hosted","sunshine","moonlight","game-streaming"],"confidence":0.6,"needs_auth":"yes","worst_case":"A previously paired client regains streaming access after being disabled","analyst_note":"","how_to_check":"- Check the installed Sunshine version against `2026.906.222525`; versions from `2026.329.165800` up to but not including `2026.906.222525` are affected.\n- Review the paired clients list in the Sunshine web UI for clients that were disabled but should no longer have access.","needs_analyst":false,"not_affected_if":["never-paired-clients","fixed-version"],"who_is_affected":"Only hosts running Sunshine from 2026.329.165800 through builds before 2026.906.222525 are exposed, and only against clients that were previously paired with the host. A client that was never paired cannot exploit this, so hosts where pairing is not used or where all paired clients are trusted can deprioritize it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00063,"input_tokens":3438,"output_tokens":572,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111044':13A,16A '-2026':12A,15A '2026.329.165800':87C '2026.906.222525':89C,188C 'accept':36B,91C 'access':74B 'also':122C,157C 'altern':9A,141C 'bypass':5A,67B,149C 'cannot':169C 'canonic':125C 'caus':158C 'certif':10A,39B,45B,65B,94C,103C,111C,119C,142C,147C 'chain':40B,96C 'client':3A,38B,56B,93C,102C,132C,160C,164C,177C 'compar':123C 'control':7A,70B,152C 'could':156C 'cve':11A,14A 'deriv':64B,143C 'disabl':6A,69B,151C 'enabl':51B,116C 'encod':128C,155C 'equival':126C,153C 'exact':50B,115C 'fix':185C 'game':18B,31B,81C 'game-stream':17B 'handl':162C 'hold':57B 'host':24B,30B,33B,80C,83C 'ident':52B,118C,161C 'inconsist':159C 'instead':46B 'issu':172C,183C 'keep':72B 'key':60B,137C 'moonlight':20B,35B,85C 'never':167C 'packag':21B 'pair':2A,44B,55B,101C,117C,131C,146C,168C,176C 'paired-cli':100C 'pem':127C,154C 'present':62B,110C,139C 'previous':54B,130C 'privat':59B,136C 'relationship':181C 'remov':174C,178C 'requir':48B,108C 'retain':134C 'self':23B,29B,79C 'self-host':22B,28B,78C 'store':43B,99C 'stream':19B,32B,73B,82C 'sunshin':1A,25B,26B,75C,90C 'text':120C 'trust':180C 'use':170C 'version':187C 'without':124C","nicknames":[],"mitigations":[],"who_affected":"Only hosts running Sunshine from 2026.329.165800 through builds before 2026.906.222525 are exposed, and only against clients that were previously paired with the host. A client that was never paired cannot exploit this, so hosts where pairing is not used or where all paired clients are trusted can deprioritize it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T22:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111044","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111044","severity":null,"published_at":"2026-10-16T22:17:20+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}