← Back

CVE-2024-31221

nvd nist
Published: Apr 8, 2024Modified: Jun 17, 2026

JSON object

Loading...
5.9
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L
Exploitability: 1.2 / Impact: 4.7
Source: security-advisories@github.com (Secondary)

Description

Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all devices in the web UI interface and then pairing only one device, all of the previously devices will be temporarily paired. Version 0.23.0 contains a patch for the issue. As a workaround, restarting Sunshine after unpairing all devices prevents the vulnerability.

Affected (1)

Products: Lizardbyte: Sunshine
Lizardbyte
1 product
Sunshine
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Sunshine
From 0.10.0 to 0.23.0

Related CWEs

CWE-384
Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (8)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
ExploitIssue Tracking
Source: security-advisories@github.com
Issue TrackingPatch
Source: security-advisories@github.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue Tracking
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingPatch
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.