LizardByte Sunshine, a self-hosted game streaming host for Moonlight, suffered from an improper authentication vulnerability (CWE-287) due to flawed handling of OpenSSL verification results. Specifically, in versions before 2026.516.143833, the custom verify callback in src/crypto.cpp treats X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY, X509_V_ERR_CERT_NOT_YET_VALID, and X509_V_ERR_CERT_HAS_EXPIRED as successful verification, allowing untrusted certificates to bypass authentication. This enables unauthorized access to HTTPS endpoints protected by client-certificate authentication. The vulnerability is tracked as CVE-2026-32253 with a CVSS 3.1 score of 9.8 (critical). The issue has been resolved in version 2026.516.143833.

Successful exploitation allows an attacker to bypass client-certificate authentication and access protected HTTPS endpoints without valid certificates. This compromises confidentiality, integrity, and availability of the affected service, potentially exposing sensitive streaming data or control interfaces. The CVSS score of 9.8 reflects the critical nature of this vulnerability with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Upgrade LizardByte Sunshine to version 2026.516.143833 or later, where this vulnerability has been fixed. Since the vendor advisory confirms the fix in this version, applying this update fully mitigates the issue. No additional mitigations are indicated by the vendor advisory.