CVE-2025-53096
- Source
- https://cve.org/CVERecord?id=CVE-2025-53096
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-53096.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-53096
- Aliases
-
- GHSA-x97g-h2vp-g2c5
- Published
- 2025-07-01T01:33:01.336Z
- Modified
- 2026-07-15T00:27:29.147233Z
- Severity
-
- 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L CVSS Calculator
- Summary
- Sunshine clickjacking in the UI leads to unauthorized actions being performed
- Details
-
Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks. This vulnerability allows an attacker to embed the Sunshine interface within a malicious website using an invisible or disguised iframe. If a user is tricked into interacting (one or multiple clicks) with the malicious page while authenticated, they may unknowingly perform actions within the Sunshine application without their consent. This issue has been patched in version 2025.628.4510.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53096.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-1021" ] }- References
Affected packages
Git / github.com/lizardbyte/sunshine
Affected ranges
- Type
- GIT
- Repo
- https://github.com/lizardbyte/sunshine
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
{ "source": [ "CPE_RANGE", "REFERENCES" ], "extracted_events": [ { "introduced": "0" }, { "fixed": "2025.628.4510" } ], "cpe": "cpe:2.3:a:lizardbyte:sunshine:*:*:*:*:*:*:*:*" }
Affected versions
v0.*
v0.1.0
v0.1.1
v0.10.0
v0.11.0
v0.11.1
v0.2.0
v0.3.0
v0.3.1
v0.4.0
v0.8.0
v0.9.0
v2025.*
v2025.118.151840
v2025.122.141614
Database specific
vanir_signatures_modified
"2026-07-15T00:27:29Z"
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-53096.json"
vanir_signatures
[
{
"source": "https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc",
"signature_version": "v1",
"digest": {
"length": 306.0,
"function_hash": "307887161629184574010515726156724406604"
},
"deprecated": false,
"id": "CVE-2025-53096-0a75c25b",
"signature_type": "Function",
"target": {
"file": "src/confighttp.cpp",
"function": "getIndexPage"
}
},
{
"source": "https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc",
"signature_version": "v1",
"digest": {
"length": 281.0,
"function_hash": "314303817524968373118018800451957206877"
},
"deprecated": false,
"id": "CVE-2025-53096-0a7e8465",
"signature_type": "Function",
"target": {
"file": "src/confighttp.cpp",
"function": "getFaviconImage"
}
},
{
"source": "https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc",
"signature_version": "v1",
"digest": {
"length": 384.0,
"function_hash": "14355825628495035334775524576883802025"
},
"deprecated": false,
"id": "CVE-2025-53096-2736d004",
"signature_type": "Function",
"target": {
"file": "src/confighttp.cpp",
"function": "getAppsPage"
}
},
{
"source": "https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc",
"signature_version": "v1",
"digest": {
"length": 286.0,
"function_hash": "222308005601620236216661897543849029807"
},
"deprecated": false,
"id": "CVE-2025-53096-41b3a8f5",
"signature_type": "Function",
"target": {
"file": "src/confighttp.cpp",
"function": "getSunshineLogoImage"
}
},
{
"source": "https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc",
"signature_version": "v1",
"digest": {
"length": 337.0,
"function_hash": "48709012949249973671287429677033260330"
},
"deprecated": false,
"id": "CVE-2025-53096-44ce8596",
"signature_type": "Function",
"target": {
"file": "src/confighttp.cpp",
"function": "getLogs"
}
},
{
"source": "https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc",
"signature_version": "v1",
"digest": {
"length": 625.0,
"function_hash": "220340785367668422024546706773841120847"
},
"deprecated": false,
"id": "CVE-2025-53096-53471bfe",
"signature_type": "Function",
"target": {
"file": "src/confighttp.cpp",
"function": "send_unauthorized"
}
},
{
"source": "https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc",
"signature_version": "v1",
"digest": {
"length": 358.0,
"function_hash": "85729931551301019444308250468963109751"
},
"deprecated": false,
"id": "CVE-2025-53096-63dfe4af",
"signature_type": "Function",
"target": {
"file": "src/confighttp.cpp",
"function": "getWelcomePage"
}
},
{
"source": "https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc",
"signature_version": "v1",
"digest": {
"length": 856.0,
"function_hash": "296978483156103058110086089188244102225"
},
"deprecated": false,
"id": "CVE-2025-53096-6476bd97",
"signature_type": "Function",
"target": {
"file": "src/confighttp.cpp",
"function": "getNodeModules"
}
},
{
"source": "https://github.com/lizardbyte/sunshine/commit/65f14e1003f831e776c170621bd06d8292f65155",
"signature_version": "v1",
"digest": {
"line_hashes": [
"212956361864509626197879692058320906524",
"184840781174164536877521092334400672444",
"283106148898810440707172633955193446049",
"268925405016830700229153979821007473362",
"255616432110605973807457280840205954922",
"203215498917427026273234561746737700266",
"240605006573948468832353187021843097117",
"213073478700809629252658669702218518016"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2025-53096-6ba58442",
"signature_type": "Line",
"target": {
"file": "src/config.cpp"
}
},
{
"source": "https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc",
"signature_version": "v1",
"digest": {
"length": 309.0,
"function_hash": "271062351595603445580834449591339135154"
},
"deprecated": false,
"id": "CVE-2025-53096-6e7ae9f6",
"signature_type": "Function",
"target": {
"file": "src/confighttp.cpp",
"function": "getPasswordPage"
}
},
{
"source": "https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc",
"signature_version": "v1",
"digest": {
"line_hashes": [
"33871793288061329737392741853283924444",
"252846434665342647694603662144469974808",
"163884126042056836626778882513097327497",
"167105628155519988263369205177018766278",
"202638423257077544120596140740205732529",
"104707378506258883745099694410139962420",
"65085150207592838153365746935255523165",
"323008308484771542003313366138493700027",
"335283987084498083699552916709254572311",
"156571091424311835532684389147333252125",
"197505119424121057544777119105376594559",
"81374679633622654027899035412627239919",
"176432271101021762006605601331251239678",
"152667714300677252010733350646229300357",
"340237815480013885304551670643483370712",
"223109244952140978582746288834063391831",
"185331558029844238233133894906968256472",
"152667714300677252010733350646229300357",
"168004965040173550165557761777835647607",
"249498436542669873685795360312177350820",
"249499821854136067730811834235942733967",
"255535139141249080292502858997004735155",
"199865549825424328485499627257865333869",
"126452327578283462349021263509396533109",
"203508168655254535602527286542232034560",
"255535139141249080292502858997004735155",
"11522240557469402338856670494658395996",
"66341254861653660365442189794988092185",
"231306966905734335482944539735954370865",
"274779812910695997101835310283631348412",
"217614721083497319660410027684698243214",
"150251511097082289947929349408780507854",
"254926965185053326536047619336201614237",
"255535139141249080292502858997004735155",
"268161419077160276799218279616664448070",
"267408494660473626488054783874846538808",
"187349394411345147486946147349312320404",
"255535139141249080292502858997004735155",
"134001437882453708350341224398774557094",
"230150838764018127326267670275682061032",
"77489054693331574457495103832768046383",
"255535139141249080292502858997004735155",
"24857526036671392042305427131393594585",
"274177085799330491251318727179363772346",
"314121537862882497957680202718622747589",
"255535139141249080292502858997004735155",
"185578857057909666282492497840066352169",
"61888447471180117447816347095241615702",
"25752916461299816200995367548952750397",
"255535139141249080292502858997004735155",
"247926690245087497543494752907601651665",
"144109293438614607204961307042245736830",
"90700606434194799096714294461664399001",
"8019946001928036064669295053399779416",
"102178604666720162928975568409831281840",
"32664395350982822926153326672750532253",
"116257717886105197980576760090887370697",
"282954582877720579311215918976964085833",
"233459797659614235270893608191994005514",
"41337058280623982354914993009593877215",
"268260107053341189530104997560848305297",
"198762305548062513253913719298971618166",
"199915328290544128149693414932888752641",
"173975464691948711209753341238606565868",
"123487086182169734540819802706192628073",
"28617667395217020217496550297541156513",
"303428947035308491598555738953090059568"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2025-53096-74c4ddd8",
"signature_type": "Line",
"target": {
"file": "src/confighttp.cpp"
}
},
{
"source": "https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc",
"signature_version": "v1",
"digest": {
"length": 308.0,
"function_hash": "113386582048496834057658916124541506770"
},
"deprecated": false,
"id": "CVE-2025-53096-7dda1bc6",
"signature_type": "Function",
"target": {
"file": "src/confighttp.cpp",
"function": "getClientsPage"
}
},
{
"source": "https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc",
"signature_version": "v1",
"digest": {
"length": 316.0,
"function_hash": "228133322866018052497835077262186982164"
},
"deprecated": false,
"id": "CVE-2025-53096-966d43da",
"signature_type": "Function",
"target": {
"file": "src/confighttp.cpp",
"function": "getTroubleshootingPage"
}
},
{
"source": "https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc",
"signature_version": "v1",
"digest": {
"length": 403.0,
"function_hash": "125794108751554192834838507921425858078"
},
"deprecated": false,
"id": "CVE-2025-53096-af3e1c74",
"signature_type": "Function",
"target": {
"file": "src/confighttp.cpp",
"function": "send_redirect"
}
},
{
"source": "https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc",
"signature_version": "v1",
"digest": {
"length": 304.0,
"function_hash": "133890633404785497092357761764802643546"
},
"deprecated": false,
"id": "CVE-2025-53096-c209f956",
"signature_type": "Function",
"target": {
"file": "src/confighttp.cpp",
"function": "getPinPage"
}
},
{
"source": "https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc",
"signature_version": "v1",
"digest": {
"length": 168.0,
"function_hash": "27472195915035619764513097687906023258"
},
"deprecated": false,
"id": "CVE-2025-53096-c881e38d",
"signature_type": "Function",
"target": {
"file": "src/confighttp.cpp",
"function": "send_response"
}
},
{
"source": "https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc",
"signature_version": "v1",
"digest": {
"length": 307.0,
"function_hash": "310379448733369194027057397857328201308"
},
"deprecated": false,
"id": "CVE-2025-53096-d2c91d3a",
"signature_type": "Function",
"target": {
"file": "src/confighttp.cpp",
"function": "getConfigPage"
}
}
]