CVE-2025-53096

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks. This vulnerability allows an attacker to embed the Sunshine interface within a malicious website using an invisible or disguised iframe. If a user is tricked into interacting (one or multiple clicks) with the malicious page while authenticated, they may unknowingly perform actions within the Sunshine application without their consent. This issue has been patched in version 2025.628.4510.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/LizardByte/Sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc
https://github.com/LizardByte/Sunshine/security/advisories/GHSA-x97g-h2vp-g2c5

Configurations

No configuration.

History

03 Jul 2025, 15:14

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-01 02:15

Updated : 2025-07-03 15:14

NVD link : CVE-2025-53096

Mitre link : CVE-2025-53096

CVE.ORG link : CVE-2025-53096

JSON object : View

Products Affected

No product.

CWE

CWE-1021

Improper Restriction of Rendered UI Layers or Frames

{"id": "CVE-2025-53096", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2025-07-01T02:15:22.717", "references": [{"url": "https://github.com/LizardByte/Sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc", "source": "security-advisories@github.com"}, {"url": "https://github.com/LizardByte/Sunshine/security/advisories/GHSA-x97g-h2vp-g2c5", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1021"}]}], "descriptions": [{"lang": "en", "value": "Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks. This vulnerability allows an attacker to embed the Sunshine interface within a malicious website using an invisible or disguised iframe. If a user is tricked into interacting (one or multiple clicks) with the malicious page while authenticated, they may unknowingly perform actions within the Sunshine application without their consent. This issue has been patched in version 2025.628.4510."}, {"lang": "es", "value": "Sunshine es un servidor de streaming de juegos autoalojado para Moonlight. Antes de la versi\u00f3n 2025.628.4510, la interfaz web de Sunshine carec\u00eda de protecci\u00f3n contra ataques de clickjacking. Esta vulnerabilidad permite a un atacante integrar la interfaz de Sunshine en un sitio web malicioso mediante un iframe invisible o camuflado. Si se enga\u00f1a a un usuario para que interact\u00fae (uno o varios clics) con la p\u00e1gina maliciosa mientras est\u00e1 autenticado, podr\u00eda realizar acciones dentro de la aplicaci\u00f3n Sunshine sin su consentimiento. Este problema se ha corregido en la versi\u00f3n 2025.628.4510."}], "lastModified": "2025-07-03T15:14:12.767", "sourceIdentifier": "security-advisories@github.com"}