LizardByte Sunshine EUVD-2026-103189

Exploitation requires that the attacker's client was previously paired with the target Sunshine host AND that the attacker still holds that paired client's private key; a client that was never paired cannot exploit this. The specific condition being abused is the Sunshine 'Disable' control for a paired client - the flaw lets a Disabled-but-not-removed client regain GameStream access. Limiting factors: the trust relationship is fully severed if the operator REMOVES (rather than merely Disables) the paired client, exploitation is confined to the affected versions 2026.329.165800 through pre-2026.906.222525, and the attacker must be able to reach Sunshine's GameStream HTTPS endpoint over the network.

This is a genuine authorization-bypass (CWE-863) in LizardByte Sunshine, but the available signals point to moderate, conditional risk rather than broad emergency priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, base 7.6 High) correctly reflects that exploitation is network-reachable and low-complexity but NOT unauthenticated - PR:L is consistent with the description, which states a 'previously paired client that retains its private key' is required; a never-paired client cannot exploit the flaw. No EPSS score, CISA KEV listing, or public POC was supplied in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The flaw is well-corroborated by a vendor GitHub Security Advisory (GHSA-6jvv-jqr7-m6m3) and a specific commit diff showing the root cause - acceptance of any certificate chaining to a stored paired cert plus non-canonicalized PEM comparison - which raises confidence in the technical description. The practical impact is narrow: it lets an already-trusted-then-'Disabled' client circumvent the Disable control, so it is an insider/previously-authorized-device escalation, not a path for arbitrary external attackers. Net: a legitimate fix-worthy issue for Sunshine operators who rely on the Disable control, but not a mass-exploitation threat given the prior-pairing precondition and absence of KEV/EPSS/POC signals.

A user who was previously paired with a Sunshine host but later had their device 'Disabled' by the operator still possesses the paired client's private key. They derive an alternate certificate (or re-encode the paired PEM equivalently) from that key and present it during the GameStream TLS handshake; because Sunshine only checked that the cert chained to a stored paired cert rather than matching the exact enabled identity, access is granted despite the Disable control. No public exploit code was identified in the provided data, and exploitation is limited to clients that were paired at some point.