CVE-2026-32253

In the file src/crypto.cpp, a custom OpenSSL verification callback incorrectly treats certain certificate validation error codes as positive results. Specifically, errors X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY, X509_V_ERR_CERT_NOT_YET_VALID, and X509_V_ERR_CERT_HAS_EXPIRED are handled as success instead of rejection. As a result, an untrusted, invalid, or expired certificate can successfully pass the client authentication process.

An attacker without a valid, trusted certificate can bypass the authentication mechanism and gain full access to protected HTTPS endpoints of a Sunshine instance, compromising the confidentiality, integrity, and availability of the system.

Sunshine should be updated to version 2026.516.143833 or later, where the issue has been fixed. The patch is available in the project's GitHub repository at: https://github.com/LizardByte/Sunshine/releases/tag/v2026.516.143833

Lizardbyte Sunshine in all versions prior to 2026.516.143833