Skip to main content

Sunshine CVE-2025-53096

| EUVDEUVD-2025-19598 MEDIUM
Improper Restriction of Rendered UI Layers or Frames (CWE-1021)
2025-07-01 security-advisories@github.com
XSS Sunshine Lizardbyte
5.4
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
5.4 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Lifecycle Timeline

4
EUVD ID Assigned
Mar 16, 2026 - 01:42 euvd
EUVD-2025-19598
Analysis Generated
Mar 16, 2026 - 01:42 vuln.today
Patch released
Mar 16, 2026 - 01:42 nvd
Patch available
CVE Published
Jul 01, 2025 - 02:15 nvd
MEDIUM 5.4

DescriptionGitHub Advisory

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks. This vulnerability allows an attacker to embed the Sunshine interface within a malicious website using an invisible or disguised iframe. If a user is tricked into interacting (one or multiple clicks) with the malicious page while authenticated, they may unknowingly perform actions within the Sunshine application without their consent. This issue has been patched in version 2025.628.4510.

Analysis

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks. This vulnerability allows an attacker to embed the Sunshine interface within a malicious website using an invisible or disguised iframe. If a user is tricked into interacting (one or multiple clicks) with the malicious page while authenticated, they may unknowingly perform actions within the Sunshine application without their consent. This issue has been patched in version 2025.628.4510.

Technical ContextAI

This vulnerability is classified as Improper Restriction of Rendered UI Layers or Frames (CWE-1021).

RemediationAI

A vendor patch is available. Apply it as soon as possible and verify the fix.

More in Sunshine

View all
CVE-2025-54081 MEDIUM POC
6.7 Sep 23

Sunshine is a self-hosted game stream host for Moonlight. Rated medium severity (CVSS 6.7). Public exploit code availabl
CVE-2024-31221 MEDIUM POC
5.9 Apr 08

Sunshine is a self-hosted game stream host for Moonlight. Rated medium severity (CVSS 5.9), this vulnerability is remote
CVE-2026-32253 CRITICAL
9.8 May 22

Authentication bypass in LizardByte Sunshine self-hosted game stream host (versions prior to 2026.516.143833) allows rem
CVE-2025-53095 CRITICAL
9.6 Jul 01

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks p
CVE-2024-45407 MEDIUM POC
5.3 Sep 10

Sunshine is a self-hosted game stream host for Moonlight. Rated medium severity (CVSS 5.3), this vulnerability is remote
CVE-2024-31220 HIGH
7.3 Apr 05

Sunshine is a self-hosted game stream host for Moonlight. Rated high severity (CVSS 7.3), this vulnerability is remotely
CVE-2024-31226 LOW
2.9 May 16

Sunshine is a self-hosted game stream host for Moonlight. Rated low severity (CVSS 2.9).
CVE-2025-10199 HIGH
7.8 Sep 09

A local privilege escalation vulnerability exists in Sunshine for Windows (version v2025.122.141614 and likely prior ver
CVE-2025-10198 HIGH
7.8 Sep 09

Sunshine for Windows, version v2025.122.141614, contains a DLL search-order hijacking vulnerability, allowing attackers

CVE-2024-51738 HIGH
7.7 Jan 20

Sunshine is a self-hosted game stream host for Moonlight. Rated high severity (CVSS 7.7), this vulnerability is remotely

Same weakness CWE-1021 – Improper Restriction of Rendered UI Layers or Frames

View all
CVE-2022-3167 HIGH POC
8.8
CVE-2021-3734 HIGH POC
8.8
CVE-2019-16371 HIGH POC
8.2
CVE-2024-33377 HIGH POC
8.1
CVE-2020-13119 HIGH POC
8.1
CVE-2022-1803 MEDIUM POC
6.9
CVE-2024-2177 MEDIUM POC
6.8
CVE-2024-4950 MEDIUM POC
6.5

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2025-53096 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy