What’s Vulnerable › Vulnerabilities

CVE-2024-31221: Clients removed during unpairing process may regain access if Sunshine was not restarted

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-04-08 · updated 2026-06-17
• Weakness: CWE-384

Description

Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all devices in the web UI interface and then pairing only one device, all of the previously devices will be temporarily paired. Version 0.23.0 contains a patch for the issue. As a workaround, restarting Sunshine after unpairing all devices prevents the vulnerability.

Affected products

• LizardByte Sunshine: from 0.10.0 before 0.23.0 — fixed in 0.23.0

How to fix

Upgrade to a fixed version: LizardByte Sunshine 0.23.0. Check the vendor advisory for mitigations.

References

• https://github.com/LizardByte/Sunshine/commit/b7aa8119f1471844dccdf73a8b6f7efc9baddb5e
• https://github.com/LizardByte/Sunshine/issues/2305
• https://github.com/LizardByte/Sunshine/pull/2365
• https://github.com/LizardByte/Sunshine/security/advisories/GHSA-v8gw-jw28-v55m
• https://github.com/LizardByte/Sunshine/commit/b7aa8119f1471844dccdf73a8b6f7efc9baddb5e
• https://github.com/LizardByte/Sunshine/issues/2305
• https://github.com/LizardByte/Sunshine/pull/2365
• https://github.com/LizardByte/Sunshine/security/advisories/GHSA-v8gw-jw28-v55m

Get alerted when CVE-2024-31221 or the next vulnerability affects your stack