CVE-2026-111044

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-111044

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111044.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-111044

Aliases

GHSA-6jvv-jqr7-m6m3

Published

2026-10-16T21:59:00Z

Modified

2026-10-17T13:03:45Z

Severity

7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L CVSS Calculator

Summary

Disabled Sunshine clients can bypass revocation with a derived client certificate

Details

Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate derived from its paired certificate and bypass the Disable control. Equivalent PEM encodings could also cause inconsistent client identity handling. A client that was never paired cannot use this issue, and removing the paired client removes its trust relationship. This issue is fixed in version 2026.906.222525.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111044.json"
}

References

Affected packages

Git / github.com/lizardbyte/sunshine

Affected ranges

Type

GIT

Repo

https://github.com/lizardbyte/sunshine

Events

Introduced

Fixed

cb72dffa3233c5815cd5ba88f09f049dd679ba75

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "2026.329.165800"
        },
        {
            "fixed":  "2026.906.222525"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v0.*

v0.1.0

v0.1.1

v0.10.0

v0.11.0

v0.11.1

v0.2.0

v0.3.0

v0.3.1

v0.4.0

v0.8.0

v0.9.0

v2025.*

v2025.118.151840

v2025.122.141614

v2025.628.4510

v2025.923.33222

v2025.924.154138

v2026.*

v2026.121.232953

v2026.121.33416

v2026.203.160441

v2026.204.180221

v2026.206.151412

v2026.208.203040

v2026.209.34151

v2026.211.162838

v2026.211.25443

v2026.213.34323

v2026.214.224301

v2026.214.30634

v2026.215.224211

v2026.218.44016

v2026.220.22826

v2026.221.41532

v2026.222.224531

v2026.223.155824

v2026.224.134041

v2026.225.33545

v2026.226.41312

v2026.228.232233

v2026.228.25700

v2026.302.133823

v2026.310.23228

v2026.311.154809

v2026.314.25625

v2026.331.130344

v2026.331.21700

v2026.408.194927

v2026.409.171120

v2026.507.123453

v2026.508.45922

v2026.513.230134

v2026.515.151803

v2026.516.143833

v2026.516.30826

v2026.517.140229

v2026.518.24409

v2026.520.10145

v2026.522.22447

v2026.525.145348

v2026.525.22124

v2026.527.25539

v2026.528.35537

v2026.531.163415

v2026.605.170308

v2026.608.233907

v2026.611.125516

v2026.616.153054

v2026.617.152807

v2026.619.155209

v2026.703.144423

v2026.704.34109

v2026.709.11046

v2026.712.223218

v2026.712.43005

v2026.713.170739

v2026.715.205118

v2026.723.125751

v2026.724.182739

v2026.724.5619

v2026.725.25407

v2026.726.710

v2026.808.164219

v2026.816.192458

v2026.817.185037

v2026.824.30334

v2026.826.1804

v2026.830.165455

v2026.830.223700

v2026.830.44125

v2026.831.233010

v2026.901.192748

v2026.902.143621

v2026.904.190010

v2026.904.221615

v2026.904.234309

v2026.905.212401

v2026.906.123708

v2026.906.14454

v2026.906.182512

v2026.906.195203

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111044.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "255295042007916257713926690652039828189",
                "251092669972863061421227868855609066379",
                "164722275422843848212615722824713189379",
                "70996354713800515395124297988794958508",
                "265571756318344661254600116471529466796",
                "284561194701926712104250609834816316393",
                "168830108711729032772347675719054214248",
                "63008678779004073853991215757239367313",
                "329390999718975889121370178710388233503",
                "282063703797808877270613844998483834991",
                "21153155168033708757211639855251669652",
                "196429650785385580024248771653948617223",
                "266189684647983139761302944422777107264",
                "130686247586041307180496679492112212336",
                "214666158242167555220911024231298140209",
                "246908609809929883799100427146918098061",
                "89726655063613731565997140796653860663",
                "80799660449629530701692799085040297963",
                "336160711994904980221403885756926787215",
                "305275412668246642662467506287809690162",
                "132322578886531417511585666541869719626",
                "90573788011220593746582410630522483889",
                "262542597902247335906910996877614183002",
                "245699774828964409166249899459827967729",
                "34572762770059127684577911438474591625",
                "5355386023893557195192320641821941669",
                "297465048750663869363829891622137027075",
                "270260335712360251243452427259951544542",
                "160168316860302172661618275294824109417",
                "318485108558091946376259170313327333734",
                "188733401993560748568244029806247496761"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-111044-41f76e32",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/lizardbyte/sunshine/commit/cb72dffa3233c5815cd5ba88f09f049dd679ba75",
        "target":  {
            "file":  "src/platform/linux/pipewire.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "14624825969951547686468843873537032365",
                "261107700971011675890462845529580073761",
                "132758594828088298634845667969930152593",
                "45240582418901001772142305231647888852",
                "214534994687770082390359132505128988087",
                "300495199749651435913053152864769322774",
                "162495922945057583941479299280242015911",
                "41253861337921342012622102252427782336",
                "270854722546770464485852338813726730494",
                "128336484479796709753403977148841831650",
                "162555100307861495333917883473742997702",
                "268740156384595196238412495417944591372",
                "207426241462528651198138659153272556746",
                "14624825969951547686468843873537032365",
                "261107700971011675890462845529580073761",
                "132758594828088298634845667969930152593",
                "45240582418901001772142305231647888852",
                "214534994687770082390359132505128988087",
                "300495199749651435913053152864769322774",
                "162495922945057583941479299280242015911",
                "41253861337921342012622102252427782336",
                "270854722546770464485852338813726730494",
                "128336484479796709753403977148841831650",
                "162555100307861495333917883473742997702",
                "268740156384595196238412495417944591372",
                "207426241462528651198138659153272556746"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-111044-4a8a494c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/lizardbyte/sunshine/commit/cb72dffa3233c5815cd5ba88f09f049dd679ba75",
        "target":  {
            "file":  "src/platform/linux/x11grab.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "158099945285584792753552940244688170786",
                "79699909979384918985942382849604072111",
                "242779266671628655005709979407940475200",
                "272165196494990369323524854975056140356",
                "332102190536461621780974088542219695633"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-111044-5601cab9",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/lizardbyte/sunshine/commit/cb72dffa3233c5815cd5ba88f09f049dd679ba75",
        "target":  {
            "file":  "src/platform/linux/misc.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "14624825969951547686468843873537032365",
                "261107700971011675890462845529580073761",
                "132758594828088298634845667969930152593",
                "45240582418901001772142305231647888852",
                "214534994687770082390359132505128988087",
                "300495199749651435913053152864769322774",
                "162495922945057583941479299280242015911",
                "41253861337921342012622102252427782336",
                "270854722546770464485852338813726730494",
                "128336484479796709753403977148841831650",
                "162555100307861495333917883473742997702",
                "268740156384595196238412495417944591372",
                "207426241462528651198138659153272556746",
                "14624825969951547686468843873537032365",
                "261107700971011675890462845529580073761",
                "132758594828088298634845667969930152593",
                "45240582418901001772142305231647888852",
                "214534994687770082390359132505128988087",
                "300495199749651435913053152864769322774",
                "162495922945057583941479299280242015911",
                "41253861337921342012622102252427782336",
                "270854722546770464485852338813726730494",
                "128336484479796709753403977148841831650",
                "162555100307861495333917883473742997702",
                "268740156384595196238412495417944591372",
                "207426241462528651198138659153272556746"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-111044-5a090700",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/lizardbyte/sunshine/commit/cb72dffa3233c5815cd5ba88f09f049dd679ba75",
        "target":  {
            "file":  "src/platform/linux/kmsgrab.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "229275680340172554701668764603594312944",
                "261107700971011675890462845529580073761",
                "132758594828088298634845667969930152593",
                "45240582418901001772142305231647888852",
                "214534994687770082390359132505128988087",
                "300495199749651435913053152864769322774",
                "162495922945057583941479299280242015911",
                "41253861337921342012622102252427782336",
                "270854722546770464485852338813726730494",
                "128336484479796709753403977148841831650",
                "162555100307861495333917883473742997702",
                "122461210583457433538383933140121996200",
                "311941311017946655333811999283273354212"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-111044-ef034bcf",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/lizardbyte/sunshine/commit/cb72dffa3233c5815cd5ba88f09f049dd679ba75",
        "target":  {
            "file":  "src/platform/linux/cuda.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "14624825969951547686468843873537032365",
                "261107700971011675890462845529580073761",
                "132758594828088298634845667969930152593",
                "45240582418901001772142305231647888852",
                "214534994687770082390359132505128988087",
                "300495199749651435913053152864769322774",
                "162495922945057583941479299280242015911",
                "41253861337921342012622102252427782336",
                "270854722546770464485852338813726730494",
                "128336484479796709753403977148841831650",
                "162555100307861495333917883473742997702",
                "268740156384595196238412495417944591372",
                "207426241462528651198138659153272556746",
                "14624825969951547686468843873537032365",
                "261107700971011675890462845529580073761",
                "132758594828088298634845667969930152593",
                "45240582418901001772142305231647888852",
                "214534994687770082390359132505128988087",
                "300495199749651435913053152864769322774",
                "162495922945057583941479299280242015911",
                "41253861337921342012622102252427782336",
                "270854722546770464485852338813726730494",
                "128336484479796709753403977148841831650",
                "162555100307861495333917883473742997702",
                "268740156384595196238412495417944591372",
                "207426241462528651198138659153272556746"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-111044-fc792f67",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/lizardbyte/sunshine/commit/cb72dffa3233c5815cd5ba88f09f049dd679ba75",
        "target":  {
            "file":  "src/platform/linux/wlgrab.cpp"
        }
    }
]

vanir_signatures_modified

"2026-10-17T13:03:45Z"