---
id: "CVE-2026-111044"
kind: "vulnerability"
aliases: ["CVE-2026-111044"]
title: "Sunshine: paired client can bypass disable control with alternate certificate"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["game-streaming", "moonlight", "package", "self-hosted", "sunshine"]
not_affected_if: ["fixed-version", "never-paired-clients"]
published_at: "2026-10-16T22:17:20+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:14:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111044", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Sunshine: paired client can bypass disable control with alternate certificate

Sunshine, a self-hosted game stream host for Moonlight, accepted any client certificate chaining to a stored paired certificate instead of requiring the exact enabled identity. A previously paired client holding its private key can present a derived certificate to bypass the Disable control and keep streaming access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Sunshine version against `2026.906.222525`; versions from `2026.329.165800` up to but not including `2026.906.222525` are affected.
- Review the paired clients list in the Sunshine web UI for clients that were disabled but should no longer have access.

## Fix

- Upgrade Sunshine to `2026.906.222525` or later.
- Remove any paired clients that should no longer have access, since removing a paired client removes its trust relationship.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111044

## From the sources

Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate derived from its paired certificate and bypass the Disable control. Equivalent PEM encodings could also cause inconsistent client identity handling. A client that was never paired cannot use this issue, and removing the paired client removes its trust relationship. This issue is fixed in version 2026.906.222525.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_