CVE-2024-45407

Published: Sep 10, 2024Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 1.6 / Impact: 3.6

Source: NVD

Description

Sunshine is a self-hosted game stream host for Moonlight. Clients that experience a MITM attack during the pairing process may inadvertantly allow access to an unintended client rather than failing authentication due to a PIN validation error. The pairing attempt fails due to the incorrect PIN, but the certificate from the forged pairing attempt is incorrectly persisted prior to the completion of the pairing request. This allows access to the certificate belonging to the attacker.

Affected (1)

Products: Lizardbyte: Sunshine

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Lizardbyte Sunshine	Version 2024-05-27

Related CWEs

Channel Accessible by Non-Endpoint

The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

References (3)

https://github.com/LizardByte/Sunshine/commit/5fcd07ecb1428bfe245ad6fa349aead476c7e772

Source: security-advisories@github.com

Patch

https://github.com/LizardByte/Sunshine/commit/fd7e68457a134102d1b30af5796c79f2aa623224

Source: security-advisories@github.com

Patch

https://github.com/LizardByte/Sunshine/security/advisories/GHSA-jqph-8cp5-g874

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.