PT-2025-27501 · Sunshine · Sunshine

Reenignearcher · Published 2025-07-01 · Updated 2025-08-22 · CVE-2025-53096

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Sunshine versions prior to 2025.628.4510

Description: The issue concerns a lack of protection against clickjacking attacks in the web interface of Sunshine, a self-hosted game stream host for Moonlight. This allows an attacker to embed the Sunshine interface within a malicious website using an invisible or disguised iframe. If a user is tricked into interacting with the malicious page while authenticated, they may unknowingly perform actions within the Sunshine application without their consent.

Recommendations: For versions prior to 2025.628.4510, update to version 2025.628.4510 to resolve the issue. As a temporary workaround, consider restricting access to the web UI of Sunshine to minimize the risk of exploitation. Avoid using the Sunshine web interface on untrusted devices or networks until the issue is resolved.

Exploit

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2025-53096

GHSA-X97G-H2VP-G2C5

Affected Products

Sunshine

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53096.json · Exploit
• https://github.com/LizardByte/Sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc · Patch
• https://osv.dev/vulnerability/CVE-2025-53096 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53096 · Security Note
• https://github.com/LizardByte/Sunshine/security/advisories/GHSA-x97g-h2vp-g2c5 · Note
• https://t.me/cveNotify/133176 · Telegram Post
• https://twitter.com/jmdevlabs/status/1945475168274379258 · Twitter Post
• https://t.me/cvetracker/27481 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1939882012367602105 · Twitter Post
• https://twitter.com/CVEnew/status/1939886092351652088 · Twitter Post