LizardByte Sunshine versions before 2026.516.143833 contain an authentication bypass vulnerability due to improper handling of OpenSSL verification results in the custom verify callback in src/crypto.cpp. Specifically, errors such as X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY, X509_V_ERR_CERT_NOT_YET_VALID, and X509_V_ERR_CERT_HAS_EXPIRED are incorrectly treated as successful verification. This allows an attacker presenting an untrusted or invalid certificate to bypass client-certificate authentication and gain unauthorized access to HTTPS endpoints. The vulnerability is tracked as CVE-2026-32253 with a CVSS 3.1 score of 9.8 (critical). The issue is resolved in version 2026.516.143833.

Successful exploitation allows an attacker to bypass client-certificate authentication and access protected HTTPS endpoints on the Sunshine server. This can lead to full confidentiality, integrity, and availability compromise of the affected service, as indicated by the high CVSS score (9.8) with network attack vector, no privileges required, and no user interaction needed.

Upgrade LizardByte Sunshine to version 2026.516.143833 or later, where this authentication bypass vulnerability is fixed. Since the vendor advisory confirms the fix in this version, applying this update fully mitigates the issue. No additional mitigation steps are indicated.