CVE-2026-111044: CWE-863: Incorrect Authorization in LizardByte Sunshine

Sunshine versions from 2026.329.165800 up to but not including 2026.906.222525 contain an authorization flaw where client certificates chaining to a stored paired-client certificate are accepted without verifying the exact paired identity. The software compared certificate text without canonicalizing PEM encodings, enabling a previously paired client retaining its private key to present an alternate certificate derived from the paired certificate and bypass the Disable control. This flaw does not allow unpaired clients to exploit the issue, and removing the paired client revokes trust. The vulnerability is addressed in version 2026.906.222525.

An attacker with access to a previously paired client's private key can bypass the Disable control by presenting an alternate certificate derived from the paired certificate. This results in unauthorized access despite the client being disabled. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C: High, I: Low, A: Low). Clients never paired are not affected, and trust can be revoked by removing the paired client.

Upgrade to Sunshine version 2026.906.222525 or later, where this authorization issue is fixed. Removing paired clients from the trust store also revokes their access and mitigates the risk. No other specific mitigations are indicated.