Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate derived from its paired certificate and bypass the Disable control. Equivalent PEM encodings could also cause inconsistent client identity handling. A client that was never paired cannot use this issue, and removing the paired client removes its trust relationship. This issue is fixed in version 2026.906.222525.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-863"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111044.json"
}{
"extracted_events": [
{
"range": [
{
"introduced": "2026.329.165800"
},
{
"fixed": "2026.906.222525"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"original_tag": "v2026.906.222525",
"range": [
{
"fixed": "cb72dffa3233c5815cd5ba88f09f049dd679ba75"
}
],
"source": "REFERENCES_TAG"
},
{
"range": [
{
"introduced": "0"
},
{
"fixed": "2026.906.222525"
}
],
"source": "DESCRIPTION"
}
]
}
{
"extracted_events": [
{
"range": [
{
"fixed": "4d768847fcd88cc94ac745c4611715c67d7d67e1"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111044.json"
[
{
"deprecated": false,
"digest": {
"function_hash": "251072486367406904393852741256648293038",
"length": 341
},
"id": "CVE-2026-111044-329a17c2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/sunshinestream/sunshine/commit/4d768847fcd88cc94ac745c4611715c67d7d67e1",
"target": {
"file": "src/nvhttp.cpp",
"function": "unpair_client"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"255295042007916257713926690652039828189",
"251092669972863061421227868855609066379",
"164722275422843848212615722824713189379",
"70996354713800515395124297988794958508",
"265571756318344661254600116471529466796",
"284561194701926712104250609834816316393",
"168830108711729032772347675719054214248",
"63008678779004073853991215757239367313",
"329390999718975889121370178710388233503",
"282063703797808877270613844998483834991",
"21153155168033708757211639855251669652",
"196429650785385580024248771653948617223",
"266189684647983139761302944422777107264",
"130686247586041307180496679492112212336",
"214666158242167555220911024231298140209",
"246908609809929883799100427146918098061",
"89726655063613731565997140796653860663",
"80799660449629530701692799085040297963",
"336160711994904980221403885756926787215",
"305275412668246642662467506287809690162",
"132322578886531417511585666541869719626",
"90573788011220593746582410630522483889",
"262542597902247335906910996877614183002",
"245699774828964409166249899459827967729",
"34572762770059127684577911438474591625",
"5355386023893557195192320641821941669",
"297465048750663869363829891622137027075",
"270260335712360251243452427259951544542",
"160168316860302172661618275294824109417",
"318485108558091946376259170313327333734",
"188733401993560748568244029806247496761"
],
"threshold": 0.9
},
"id": "CVE-2026-111044-41f76e32",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/lizardbyte/sunshine/commit/cb72dffa3233c5815cd5ba88f09f049dd679ba75",
"target": {
"file": "src/platform/linux/pipewire.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "94172282740375678362019936059544564531",
"length": 357
},
"id": "CVE-2026-111044-4824cdb2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/sunshinestream/sunshine/commit/4d768847fcd88cc94ac745c4611715c67d7d67e1",
"target": {
"file": "src/nvhttp.cpp",
"function": "add_authorized_client"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"268673088260508962672625268092063878551",
"225054463723562317370502601310236782794",
"134437468078333633288360214779930241905",
"147936559797311422270461767964223407680",
"136476967228669054984279951850388928938",
"164556026150688071095406205948165502886",
"176894368891670059257586770547398239754",
"272279073967882103193482824438003698024",
"293692007115526630015844452738847545929",
"257046350500602283282212459575508826249",
"64221354585918509089027090110145446100",
"333099317746712315188308809223242345559",
"58459331445118833663533331715167537034",
"14247762453148226247178930654414067825",
"94331047176508665028842611873323367340",
"329974760953603485282890355087622050745",
"25097214727583815626901581294405703756",
"42117644151379607759848247877601010664",
"94127679279280745016300838880129370790",
"34641652926827952323034897900102348038",
"169653871266294482072471508093347432687",
"205150916625248218746337706379097746419",
"70701437733926914240723795699065761817",
"95432130325507264253407699544246646515",
"70659490568260409370449072990908566113",
"13132199531506288931862280986985051666",
"31487647032949846472040350336886669117"
],
"threshold": 0.9
},
"id": "CVE-2026-111044-4a799a22",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/sunshinestream/sunshine/commit/4d768847fcd88cc94ac745c4611715c67d7d67e1",
"target": {
"file": "tests/unit/test_http_pairing.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"14624825969951547686468843873537032365",
"261107700971011675890462845529580073761",
"132758594828088298634845667969930152593",
"45240582418901001772142305231647888852",
"214534994687770082390359132505128988087",
"300495199749651435913053152864769322774",
"162495922945057583941479299280242015911",
"41253861337921342012622102252427782336",
"270854722546770464485852338813726730494",
"128336484479796709753403977148841831650",
"162555100307861495333917883473742997702",
"268740156384595196238412495417944591372",
"207426241462528651198138659153272556746",
"14624825969951547686468843873537032365",
"261107700971011675890462845529580073761",
"132758594828088298634845667969930152593",
"45240582418901001772142305231647888852",
"214534994687770082390359132505128988087",
"300495199749651435913053152864769322774",
"162495922945057583941479299280242015911",
"41253861337921342012622102252427782336",
"270854722546770464485852338813726730494",
"128336484479796709753403977148841831650",
"162555100307861495333917883473742997702",
"268740156384595196238412495417944591372",
"207426241462528651198138659153272556746"
],
"threshold": 0.9
},
"id": "CVE-2026-111044-4a8a494c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/lizardbyte/sunshine/commit/cb72dffa3233c5815cd5ba88f09f049dd679ba75",
"target": {
"file": "src/platform/linux/x11grab.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"223405837810314905610234548547311771318",
"283151495331159408984996210384567643005",
"69452835734922091693010627071556108373"
],
"threshold": 0.9
},
"id": "CVE-2026-111044-4ff0e782",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/sunshinestream/sunshine/commit/4d768847fcd88cc94ac745c4611715c67d7d67e1",
"target": {
"file": "tests/unit/test_crypto.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"158099945285584792753552940244688170786",
"79699909979384918985942382849604072111",
"242779266671628655005709979407940475200",
"272165196494990369323524854975056140356",
"332102190536461621780974088542219695633"
],
"threshold": 0.9
},
"id": "CVE-2026-111044-5601cab9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/lizardbyte/sunshine/commit/cb72dffa3233c5815cd5ba88f09f049dd679ba75",
"target": {
"file": "src/platform/linux/misc.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"14624825969951547686468843873537032365",
"261107700971011675890462845529580073761",
"132758594828088298634845667969930152593",
"45240582418901001772142305231647888852",
"214534994687770082390359132505128988087",
"300495199749651435913053152864769322774",
"162495922945057583941479299280242015911",
"41253861337921342012622102252427782336",
"270854722546770464485852338813726730494",
"128336484479796709753403977148841831650",
"162555100307861495333917883473742997702",
"268740156384595196238412495417944591372",
"207426241462528651198138659153272556746",
"14624825969951547686468843873537032365",
"261107700971011675890462845529580073761",
"132758594828088298634845667969930152593",
"45240582418901001772142305231647888852",
"214534994687770082390359132505128988087",
"300495199749651435913053152864769322774",
"162495922945057583941479299280242015911",
"41253861337921342012622102252427782336",
"270854722546770464485852338813726730494",
"128336484479796709753403977148841831650",
"162555100307861495333917883473742997702",
"268740156384595196238412495417944591372",
"207426241462528651198138659153272556746"
],
"threshold": 0.9
},
"id": "CVE-2026-111044-5a090700",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/lizardbyte/sunshine/commit/cb72dffa3233c5815cd5ba88f09f049dd679ba75",
"target": {
"file": "src/platform/linux/kmsgrab.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"224802396087642274071541630419064309195",
"332175400067936891767916301756338025126",
"232785233558861816162237951624617890150",
"192317599293203444774554402870494171775",
"253907796459441342895062762534960147849",
"242486020581564748309980922272478058673",
"114274630272967271073588453159043095404",
"191093370233727044299527167228276353142",
"205068962433039024084313852295397520444",
"35350969143872370744595872927873214238"
],
"threshold": 0.9
},
"id": "CVE-2026-111044-5aae341a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/sunshinestream/sunshine/commit/4d768847fcd88cc94ac745c4611715c67d7d67e1",
"target": {
"file": "src/nvhttp.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "3222551968728310754354118380934782968",
"length": 1839
},
"id": "CVE-2026-111044-6b15ee45",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/sunshinestream/sunshine/commit/4d768847fcd88cc94ac745c4611715c67d7d67e1",
"target": {
"file": "src/nvhttp.cpp",
"function": "load_state"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "334150769634023358650201928839088274936",
"length": 720
},
"id": "CVE-2026-111044-7157e601",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/sunshinestream/sunshine/commit/4d768847fcd88cc94ac745c4611715c67d7d67e1",
"target": {
"file": "tests/unit/test_http_pairing.cpp",
"function": "TEST"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "31278695764155422189960372034028730335",
"length": 670
},
"id": "CVE-2026-111044-9c4900e7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/sunshinestream/sunshine/commit/4d768847fcd88cc94ac745c4611715c67d7d67e1",
"target": {
"file": "src/crypto.cpp",
"function": "cert_chain_t::verify"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "279130900383075958518784155604657006274",
"length": 4386
},
"id": "CVE-2026-111044-a40c836a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/sunshinestream/sunshine/commit/4d768847fcd88cc94ac745c4611715c67d7d67e1",
"target": {
"file": "src/nvhttp.cpp",
"function": "start"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "174610378137228339309582639364548159168",
"length": 94
},
"id": "CVE-2026-111044-a647bcb9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/sunshinestream/sunshine/commit/4d768847fcd88cc94ac745c4611715c67d7d67e1",
"target": {
"file": "src/nvhttp.cpp",
"function": "erase_all_clients"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "260487144964679294917607519452896627415",
"length": 1453
},
"id": "CVE-2026-111044-a671daa2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/sunshinestream/sunshine/commit/4d768847fcd88cc94ac745c4611715c67d7d67e1",
"target": {
"file": "tests/unit/test_http_pairing.cpp",
"function": "TEST_P"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "293815691262047047453247138702060354321",
"length": 246
},
"id": "CVE-2026-111044-c3fe3a53",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/sunshinestream/sunshine/commit/4d768847fcd88cc94ac745c4611715c67d7d67e1",
"target": {
"file": "src/nvhttp.cpp",
"function": "set_client_enabled"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"10482483381512965203227583599143515622",
"197857373004371146428590318432845119404",
"105818880728072403745336018985905523987",
"288887945554523190042977274964137113851",
"18577377538699633142469929192419062233",
"71475169469853788210423575454005299493",
"180080680376048779879871948920997300729",
"152985869274763326982370217288191310361",
"39196925505238854009322902055933315226",
"326102890071892841996725224663009636690",
"60977169716434091818608057656735423602",
"332281099716757785557507239913545701804",
"331349014860292239299078223790784009762",
"73551414148029511664851919033808304703",
"65627105957216586594982303390350176614",
"175870931273236223176298429896454579232",
"99785816320806779345411314516787780702",
"336369477300898593154879785374223030439"
],
"threshold": 0.9
},
"id": "CVE-2026-111044-c5fda2ca",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/sunshinestream/sunshine/commit/4d768847fcd88cc94ac745c4611715c67d7d67e1",
"target": {
"file": "src/crypto.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "139154249736089532687458550557520357961",
"length": 185
},
"id": "CVE-2026-111044-db900f73",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/sunshinestream/sunshine/commit/4d768847fcd88cc94ac745c4611715c67d7d67e1",
"target": {
"file": "src/nvhttp.cpp",
"function": "get_cert_by_uuid"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "172045836989987268128339447565846475748",
"length": 303
},
"id": "CVE-2026-111044-ecde4fa2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/sunshinestream/sunshine/commit/4d768847fcd88cc94ac745c4611715c67d7d67e1",
"target": {
"file": "src/nvhttp.cpp",
"function": "get_all_clients"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"229275680340172554701668764603594312944",
"261107700971011675890462845529580073761",
"132758594828088298634845667969930152593",
"45240582418901001772142305231647888852",
"214534994687770082390359132505128988087",
"300495199749651435913053152864769322774",
"162495922945057583941479299280242015911",
"41253861337921342012622102252427782336",
"270854722546770464485852338813726730494",
"128336484479796709753403977148841831650",
"162555100307861495333917883473742997702",
"122461210583457433538383933140121996200",
"311941311017946655333811999283273354212"
],
"threshold": 0.9
},
"id": "CVE-2026-111044-ef034bcf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/lizardbyte/sunshine/commit/cb72dffa3233c5815cd5ba88f09f049dd679ba75",
"target": {
"file": "src/platform/linux/cuda.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"138584403207110663067261528413471817361",
"326596919701888601990032255582792005617",
"339930686319103498909017175950722434399",
"46546002591605813651439297871249285864",
"144736796472272842220120977238971911817",
"193903858139581420337756331805121451625",
"50973167149427795171218233630415576166",
"267364889845600097971049715758074353932",
"74682035833749360867318492513326595564",
"280194841654121811908122346314126641112",
"194165971690099027636957912244277568925",
"12360749148366277725172414034832503061",
"237050517313464669091428156554505752171",
"185814915075335995001169138713783323017",
"75873702530424087578152550684618744459",
"3744481777335829234388995490020709214",
"93973518950169293663012902899146539516",
"291088483861078349345213934167535093170",
"119351528046655462784683491989793491282",
"48536069846521811500569212857943512186",
"39368233097650467187636716458537670972",
"129180955225896023517359781454650559946",
"337767993733315332631244880728045303835",
"28082434030205042311772937606777346384",
"18469531649329962746769742190353504963",
"146689278243116358489356909801152753863",
"291159471550074175362930226273256751960",
"83988742840992496895984796089023638234",
"116112767915035484814217666291744102023",
"37670594525843544856323957330345219801",
"271619838065175159280172655958724893558",
"46836984267238909117041425983641168588",
"27196049401266553543437307926625157144",
"307677115417301834988456425178137406862",
"339806018943704524456898714262942667269",
"45434484920319905529388134914947869080",
"20004474341899428785221812879681988373",
"259830701947304498906439572390727856900",
"292241593936040603167775923107355193707",
"275516049213398296123598111868068920483",
"278040503952591891117233400988151487694",
"16170203125150525090022256836244939684",
"165656005426403302489620588327887565124",
"247701546568202989567769862226482552577",
"117403621688519906641854292654792694308",
"164435762400728961577453644862409825603",
"257641829652020284113430440962713183720",
"146094196986561182326528957314549262076",
"265682381596110391267032391376574549551",
"138527627729064225190825294798703190639",
"5113455648040472365624388380168666822",
"36624034178089158127432372547425217552",
"131143704042325436309823192643101120510",
"298893795249251907164186976992641777668",
"170032862026123576374700657139479300470",
"279869385572064058238390467993843836695",
"88900426475204953588421285438512710411",
"130933442231131090804431260711036499706",
"179494330139702618499214775189538148123",
"105938080176122969637885219859018301424",
"336691184285247824084592602595324073233",
"283994923024370830719848769284015590212",
"323527056835347557457897282333768088801",
"116524684549085017989132054599357286963",
"174623880299561431648909859573200469419",
"92887145155111512738282614994495875980",
"182168832460389465491158225668235721333",
"224455838610847376390358970004902855787",
"225032830967395674001948303238002741308",
"113403570912971336323396004936960492979",
"35827708927178882367266520016300649411",
"159112752481276257018129751571370291858",
"223914743804154122899229736603613455442",
"145092908174176802966453363148233849858",
"224758016863515942833220302971560391352",
"72385329599982046071209160486114709009",
"14452175124930119378994991983830254718",
"7740675078066185367658920953219869608",
"337052774703801416996564069302243258068",
"227814627300728542718481786192844845018",
"173138494412982430640195089559591413848",
"335815788603884373563028344484167954671",
"194346957135855136273290180568429019036",
"274738572758088079183948620060385018378",
"14796791213644145400055843623426112907",
"303394495456109953416886710593238375651",
"1970152494990714767665361609872976651",
"269454340708937042874318763120320947113",
"141117007959748024192834532183527861969",
"57209845404239662441884472759679538321",
"215930326487870810589410299544410205726",
"298349841550314033249265092793727406956",
"263868967427693212434508889378790167882",
"227324412895158956348060835926678381638",
"99260962079085040987751821672796288885",
"263874873900518247222975286406834571741",
"66736321565935894008216936085913868196",
"32288621302197590825313859684843729637",
"33980415225584004317797871535025463846",
"286580101260353356498567696450885050224",
"161373953298324472933386584840465237908",
"46057630497654970568688717222677286427",
"259860995019148208618339468602176031588",
"279425711038647288517607476180481098285",
"315749177882437479795946754607443087595",
"183779158255208666439206567173340613001",
"145299350130293419139323904050415008624",
"115521372907369140931780146981675903383",
"133379509278462751425157601398192406239",
"12684880851312380945787256636005828593",
"56452535098618868477202177938317901344",
"246134854697918997098218374487061484064",
"158383701766521914648625759780884902299",
"240902594564670375070157333445817262693",
"107928133293115510266350938850027980912",
"5067531802993503088734341297734745990"
],
"threshold": 0.9
},
"id": "CVE-2026-111044-f93dcdad",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/sunshinestream/sunshine/commit/4d768847fcd88cc94ac745c4611715c67d7d67e1",
"target": {
"file": "src/nvhttp.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"14624825969951547686468843873537032365",
"261107700971011675890462845529580073761",
"132758594828088298634845667969930152593",
"45240582418901001772142305231647888852",
"214534994687770082390359132505128988087",
"300495199749651435913053152864769322774",
"162495922945057583941479299280242015911",
"41253861337921342012622102252427782336",
"270854722546770464485852338813726730494",
"128336484479796709753403977148841831650",
"162555100307861495333917883473742997702",
"268740156384595196238412495417944591372",
"207426241462528651198138659153272556746",
"14624825969951547686468843873537032365",
"261107700971011675890462845529580073761",
"132758594828088298634845667969930152593",
"45240582418901001772142305231647888852",
"214534994687770082390359132505128988087",
"300495199749651435913053152864769322774",
"162495922945057583941479299280242015911",
"41253861337921342012622102252427782336",
"270854722546770464485852338813726730494",
"128336484479796709753403977148841831650",
"162555100307861495333917883473742997702",
"268740156384595196238412495417944591372",
"207426241462528651198138659153272556746"
],
"threshold": 0.9
},
"id": "CVE-2026-111044-fc792f67",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/lizardbyte/sunshine/commit/cb72dffa3233c5815cd5ba88f09f049dd679ba75",
"target": {
"file": "src/platform/linux/wlgrab.cpp"
}
}
]
"2026-11-12T07:04:11Z"