CVE-2026-111044

Executive Summary

CVE-2026-111044 is an improper authorization vulnerability (CWE-863) in Sunshine, a self-hosted game stream host for Moonlight, affecting versions from 2026.329.165800 through 2026.906.222525. The flaw allows a previously paired client that still holds its private key to present an alternate client certificate derived from its legitimate paired certificate, thereby bypassing the administrator's Disable control and retaining unauthorized access to the streaming host. With a CVSS score of 7.6, the vulnerability is exploitable by an authenticated attacker (a paired client) over the network with high confidentiality impact and low integrity/availability impact.

Technical Analysis

Sunshine implements a client pairing model in which a client presents a certificate during the TLS/authentication handshake, and the server validates it against a stored set of paired-client certificates. The core defect is an identity-matching failure that manifests in two distinct ways:

1. Chain-based trust without exact-identity enforcement. From version 2026.329.165800 onward, Sunshine accepted any client certificate that chained to a stored paired-client certificate. However, it did not require the presented certificate to be the exact enabled paired identity. In cryptographic terms, a client certificate acts as the trust anchor, and any certificate signed by (or derived from) that anchor — rather than only the precise certificate originally paired — would satisfy the trust check. An attacker who possesses the private key corresponding to a previously paired certificate can therefore mint an alternate certificate derived from their paired identity and authenticate successfully, even after the administrator disables the paired client in the UI.

2. Non-canonical PEM comparison. Client certificate text was compared without canonicalizing equivalent PEM encodings. PEM is a base64-encoded representation of DER data, and multiple textually distinct PEM blobs can decode to identical certificate structures (for example, differing line wrapping, whitespace, header details, or encoding variations that represent the same underlying certificate). Because the comparison operated on raw text rather than a canonical DER fingerprint, equivalent PEM encodings could be treated as distinct clients, leading to inconsistent identity handling — including scenarios where a disabled client could evade the disable control or where the same identity was treated as separate entities.

The attack surface is the network-facing client authentication endpoint of the Sunshine streaming host. Authorization is enforced only at the "exact enabled paired certificate" and "textual equality" level, which is insufficient to bind authentication to a single, administrator-approved credential. The vulnerability class is improper authorization through flawed identity verification: the server trusts a relationship (certificate chaining) rather than a precise credential (certificate fingerprint/subject canonicalization).

Critically, the vulnerability does not allow an unpaired client to gain access — the attacker must already be a legitimately paired client possessing its private key. Removing the paired client (revoking trust) also eliminates the trust relationship, which serves as the effective containment measure.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class (improper authorization / certificate identity confusion).

1) Reconnaissance and target identification. The attacker must have previously completed the legitimate pairing process with the target Sunshine host and possess the private key corresponding to the paired client certificate. Reconnaissance consists of confirming the host is a Sunshine instance running an affected build (version range 2026.329.165800 until 2026.906.222525) and that the attacker's pairing remains configured. The attacker may also observe whether the administrator has since disabled their paired client via the Disable control.

2) Triggering the flaw. Rather than presenting the original paired certificate directly, the attacker generates an alternate certificate derived from the paired certificate (leveraging the paired certificate's private key), or presents an equivalent-but-textually-different PEM encoding of the certificate. Due to the missing exact-identity check and the lack of PEM canonicalization, Sunshine accepts the presented credential as satisfying the stored trust relationship. The administrator's Disable action on the original paired identity no longer blocks the attacker.

3) Execution at the vulnerability-class level. The attacker completes the client authentication handshake using the derived/alternate certificate and proceeds to establish a streaming session. No authentication bypass for unpaired clients is possible; the payload here is the crafted certificate along with the already-held private key. The attack is low complexity (AC:L) and requires only low privileges (PR:L) — the paired-client relationship.

4) Post-exploitation impact. Successful exploitation grants the attacker continued access to the game streaming host as an authorized client — streaming sessions, display/input channel access, and any host resources exposed through the streaming session. The high confidentiality impact (C:H) reflects unauthorized observation of the host's display output; low integrity and availability impacts (I:L/A:L) reflect limited ability to interact with or disrupt the host. The attacker retains access despite administrative revocation attempts, requiring the administrator to fully remove the paired client rather than merely disable it.

Impact Assessment

Business context. Self-hosted Sunshine hosts are typically deployed on personal or small-team machines — often gaming PCs, media, or lab workstations — and may sit on networks alongside other systems. A disabled-but-persisting client represents a governance and access-control failure: administrators believe access has been revoked when it has not.

CVSS (7.6 HIGH, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L):

• Attack Vector: Network — the flaw is triggered through the client authentication path.
• Attack Complexity: Low — no race conditions or special preconditions beyond holding the private key.
• Privileges Required: Low — attacker must be a previously paired client.
• User Interaction: None — no administrator action required during exploitation.
• Confidentiality: High — unauthorized stream observation of the host display.
• Integrity/Availability: Low — constrained host interaction and disruption.
• Scope: Unchanged — impact confined to the Sunshine host.

Blast radius. Limited to hosts where the attacker holds a previously paired certificate and its private key, and where the pairing has not been fully removed. Unpaired clients are unaffected. The persistence aspect raises risk: access survives the Disable control, meaning revocation procedures based solely on the UI toggle are unreliable.

Detection Guidance

Sigma Rule

title: Sunshine Paired Client Certificate Bypass - Disabled Client Reconnection Attempt
id: 8f2c1a4e-1110-44cc-9b7e-sunshine111044
status: experimental
description: Detects Sunshine streaming host logging successful client authentication for a client identity that was administratively disabled or for an alternate certificate derived from a paired identity.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-111044
author: valtersit.com threat intelligence
date: 2026/09/07
logsource:
  product: sunshine
  service: stream_host
detection:
  selection_disabled:
    event_type: 'client_auth'
    auth_result: 'success'
    client_state: 'disabled'
  selection_alt_cert:
    event_type: 'client_auth'
    auth_result: 'success'
    cert_match: 'chain_only'
  condition: selection_disabled or selection_alt_cert
falsepositives:
  - Administrative re-enable of a client immediately before authentication
  - Legitimate client re-pairing during the same window
level: high
tags:
  - attack.t1078
  - cve.2026.111044

YARA Rule

rule CVE_2026_111044_Sunshine_Paired_Cert_Bypass
{
    meta:
        description = "Detects Sunshine configuration/state artifacts indicating disabled paired clients still trusted or non-canonical PEM client entries"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-111044"
        cve = "CVE-2026-111044"
        date = "2026-09-07"
    strings:
        $pem_begin = "-----BEGIN CERTIFICATE-----"
        $pem_end   = "-----END CERTIFICATE-----"
        $paired    = "paired" nocase ascii wide
        $disabled  = "disabled" nocase ascii wide
        $client    = "client" nocase ascii wide
    condition:
        uint16(0) == 0x5A42 or
        (2 of ($pem_begin, $paired, $disabled, $client) and $pem_begin and $pem_end)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET 47984 (msg:"CVE-2026-111044 Sunshine client cert authentication attempt with non-canonical/derived paired certificate"; flow:established,to_server; content:"|16 03|"; depth:1; content:"|0b|"; within:2; classtype:attempted-user; reference:cve,2026-111044; sid:2026111044; rev:1;)

Note: A precise protocol-level signature for certificate-chain identity confusion is not feasible without payload visibility into Sunshine's application-level pairing exchange; the rule above flags authenticated TLS client handshakes on the Sunshine streaming port for correlation with server-side logs. Deploy network-IDS in conjunction with host telemetry.

Elastic Detection

sequence by host.name with maxspan=10s
  [any where event.category == "authentication" and event.action == "client_auth" and client_state == "disabled"]
  [any where event.category == "authentication" and event.action == "client_auth" and event.outcome == "success"]

Splunk SPL Query

index=sunshine sourcetype="sunshine:auth"
| search event_type="client_auth" auth_result="success"
| eval bypass_indicator=if(client_state="disabled" OR cert_match="chain_only", "SUSPECTED_CVE_2026_111044", "ok")
| where bypass_indicator="SUSPECTED_CVE_2026_111044"
| stats count min(_time) as first_seen max(_time) as last_seen values(client_id) as clients by host, src_ip
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="sunshine,cve-2026-111044,">
  <rule id="100044" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">client_auth</field>
    <field name="auth_result">success</field>
    <field name="client_state">disabled</field>
    <description>CVE-2026-111044: Sunshine authenticated a disabled paired client (certificate bypass)</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
  <rule id="100045" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_type">client_auth</field>
    <field name="auth_result">success</field>
    <field name="cert_match">chain_only</field>
    <description>CVE-2026-111044: Sunshine accepted chain-only certificate match for paired client identity</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED per tracked sources. The NVD description states the issue is fixed in version 2026.906.222525, but no patch evidence was found via tracked patch sources. Treat this as a vendor-asserted fix that requires independent verification.

1. Immediate mitigations.

   • Fully remove any paired client that should no longer have access (the description confirms that removing the paired client removes its trust relationship). Relying on the Disable control alone is insufficient against this flaw.
   • Audit the set of paired clients and their certificates; identify any disabled entries and confirm whether their private keys remain outside administrative control.
   • Restrict network reachability to the Sunshine streaming port to trusted segments/VPNs.
   • Rotate trust by removing and re-pairing only the identities that require continued access.

2. Patch/upgrade steps.

   • Upgrade to 2026.906.222525 or later, which the vendor states fixes the issue (enforces exact enabled paired-identity matching and canonicalizes PEM comparison).
   • After upgrading, re-verify that disabled clients cannot authenticate and that equivalent PEM encodings are treated as a single identity.
   • Because patch confidence is low, validate vendor release notes/signing before deployment in production.

3. Long-term hardening.

   • Enforce certificate identity comparison by canonical fingerprint (e.g., SHA-256 of DER) rather than PEM text.
   • Require the presented certificate to be exactly the enabled paired identity — never accept chain-derived alternates as equivalent.
   • Log all client authentication events with the matched identity and state; alert on auth success for disabled identities.
   • Adopt a revocation workflow that removes the pairing (not just disables) and documents key-holder accountability.

References

1. NVD — CVE-2026-111044: https://nvd.nist.gov/vuln/detail/CVE-2026-111044
2. Sunshine project (self-hosted Moonlight game stream host) — vendor repository and release notes for 2026.906.222525
3. CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
4. MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
5. FIRST.org EPSS — not yet scored for this CVE (no exploit-in-the-wild evidence or CISA KEV listing confirmed at time of analysis)