{"id":"CVE-2024-51738","summary":"Sunshine improperly enforces pairing protocol request order","details":"Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order and is thereby vulnerable to a MITM attack, potentially allowing an unauthenticated attacker to pair a client by hijacking a legitimate pairing attempt. This bug may also be used by a remote attacker to crash Sunshine. This vulnerability is fixed in 2025.118.151840.","aliases":["GHSA-3hrw-xv8h-9499"],"modified":"2026-08-12T15:13:10.017492Z","published":"2025-01-20T15:26:03.955Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-305","CWE-476","CWE-841"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51738.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51738.json"},{"type":"ADVISORY","url":"https://github.com/LizardByte/Sunshine/security/advisories/GHSA-3hrw-xv8h-9499"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-51738"},{"type":"FIX","url":"https://github.com/LizardByte/Sunshine/commit/89f097ae65277d42b5d40163d09d92e412e6d7dd"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/lizardbyte/sunshine","events":[{"introduced":"0"},{"fixed":"26566cc04db12c5bc7434e480cffa025ed838bce"},{"fixed":"89f097ae65277d42b5d40163d09d92e412e6d7dd"}],"database_specific":{"cpe":"cpe:2.3:a:lizardbyte:sunshine:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2025.118.151840"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v0.11.1","v0.11.0","v0.10.0","v0.9.0","v0.8.0","v0.4.0","v0.3.1","v0.3.0","v0.2.0","v0.1.1","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-51738.json","vanir_signatures_modified":"2026-08-12T15:13:10Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/26566cc04db12c5bc7434e480cffa025ed838bce","target":{"file":"tests/unit/test_http_pairing.cpp"},"deprecated":false,"digest":{"line_hashes":["100797209542739115812235067227520091293","329401114149137010212533541894201858521","318869231849667477070365927931170859211","217289876954024892228425605780184212001","209396242423772124008953874661009101364","333404222899660741237501109237317311480","102335417461609269863129701546020173774","252350538578695794295935125722942899083"],"threshold":0.9},"id":"CVE-2024-51738-0ba23997"},{"id":"CVE-2024-51738-12d72a6f","signature_type":"Function","signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/89f097ae65277d42b5d40163d09d92e412e6d7dd","target":{"file":"src/nvhttp.cpp","function":"serverchallengeresp"},"deprecated":false,"digest":{"function_hash":"160844498561842772932513547013655432050","length":642}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/89f097ae65277d42b5d40163d09d92e412e6d7dd","target":{"file":"src/nvhttp.h"},"deprecated":false,"digest":{"line_hashes":["152133854009075936021671759599997096250","283638841872078241837862392015622334826","3110693976315495587473557067915681720","20521858407755493836249689550748332712","171598410139176887831346657875462733405","325181674624748110480919520497050182212"],"threshold":0.9},"id":"CVE-2024-51738-58e1d206"},{"digest":{"line_hashes":["177637316290372421083051170138073414163","318647337575345959730895921095160178051","102385400524116107304269715160480344042","34702977965122920093242604320575798693","122301692975203061767237739588965364352","246138113582864499747484121623450215575","205555332030114748239224817588368428666","246812980328594123412909437749483744090","66157953685514502215779555737327970307","62588485498797122242583519224974110611","181054466484073672801281205427909663502","179110802001456218046547029766577063266","93688315651898487919948228139437561569","78814872899696576948649143350634162038","305950038604487887802787900489915164369","154187611700140420347083632223123122348","307683959251109501080781789405493246230","234709789558112682171338469085430585721","64500066914564394628753590200037029520","148337318495526781630166616938294716216","281877925081731058265705109200670557376","263983579304344971487606497299026027669","51856049712552465154341756221277062366","319980826222896484009657648763298792617","338643980212166311722126653972208187926","288675966279795303720446917017057897817","103114179253385365051980237587767552304","5481304674359106557246910444042451073","273094409211521065076758546484796812221","109085706054603498588371776564211560708","47386980836366751915335778610597233817","279377080140045126839142743698611273139","290671053946075115574944933653529324805","33871828344283297408616533605113450286","31054038379690131149250867179156398432","282177496811770933157709607383764924884","39494991570148171262501290006862997527","336515193137355085654091726316763014599","299103829848781829455607028454034503791","288126285005199598958904984921628581348","136987813298785459903557174588735990487","39970531531379038424203244505113463046","259018429749801483195648651500490780762","159704393548541010468378553807704416080","326746031938751242893780945605483109625","221159435694731863283531328149941282782","58049021593175703478947477511491859829","293118651125723164481422996715243630024","179440439266901380422511557804348006945","287926690201514577367151817449165564558","97618876142897660399244549302527560130","46544818340439230747932268799032661474","161119136723736213712727099554266418938","121297437550544414210316633645846754109","217939017000037412846516997481259079144","2080701763989565661062235311951207359","216224050467751478420239690982815011371","126629094483625658598407246954195905099","201947432964981357922022122825901746088","313389546990936251266525022103058499272","243264604824205001942497097046223346531","202861624673433224385495409558548658724","28111329536341671598122186532004800793","271266136838805911821000868282462545680","243152427403126883722305744659287436779","227364848059907228665126890458870096823","89270442184099574145393694319777425627","218053157964600911814567393319843770066","44523117640595771422040324550015775631","296212390857067672032655119205604100701","327060918120647617689319256413492824238","327154016150479136158259405798145720302","161073924338990805806364425654447397769","131721747780596960165104310380396947458","144312365711628757255396904932984357414","267552123774586461070637041414174329505","97808554834488080834434960596088612362","317094987318309910635894047396508590522","83798230670534980321287266582409657233","286903009707804448727198876477076669354","72324440677496599261305909033763781091","266241883617578088187302776861376481208","58660332265150423996826594990605699438","283964962628055577436070272652538693390","120804524426805528955603254776957985881","64130668967610877524979389143144067777","158101107975327852276567570326064086418","265256838363221748293537679530765670728","214014613620120707895147270570784750","319522568797659551100244961533740016299","273873108164420199291811217392793720399","332197245400305906265314004282322521142","31852351686135534484195862130624536692","204487138462527251244591351711662235518","83701144778358228479718103857214538215","5442601723982443821996621223020930039","21039961537664253929127883339305029138","239819286939788651300307226968341600717","17261891920437475805404085067537120844","195527562349032225800554038444407503902","55806790172310508737320279476397164529","338383081913350365018805319543790712548","97369092378976240928058042499575014595","39486358478920606350372173589612034545","175591558608044441095535932073697497674","266285447159525203278549460801766956614","184224901771996503212373809267900973734","291391133208753382324558428138567874747","42455795467897399379343972800102271647","173771702568404679660825764862918366370","38241033519424096437143560635772280848","235354781614402218672049512363656655468","280663953563104666954719227725936905345","268097703864211277390832922796631741145","91152359434758411962435263362267188234","7694589537155536115591965992016084547","20891382601161696051235033901994387193","307277352426418026169516657601421100029","164523768533611518640299380602584028522","40047102688748895224771019519374644128","270668712319937779497154697286649443154","259184493381123064814045941281223646830","242023666508320512296838515213353493914","207891697706325101550846901025508815763"],"threshold":0.9},"id":"CVE-2024-51738-644dbfda","signature_type":"Line","signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/89f097ae65277d42b5d40163d09d92e412e6d7dd","target":{"file":"src/nvhttp.cpp"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/89f097ae65277d42b5d40163d09d92e412e6d7dd","target":{"file":"src/nvhttp.cpp","function":"getservercert"},"deprecated":false,"digest":{"function_hash":"7431955528319012413095498848644670818","length":770},"id":"CVE-2024-51738-dcd74b08"},{"id":"CVE-2024-51738-e3f962aa","signature_type":"Function","signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/89f097ae65277d42b5d40163d09d92e412e6d7dd","target":{"function":"start","file":"src/nvhttp.cpp"},"deprecated":false,"digest":{"function_hash":"55835972688758292967942987376578346282","length":3999}},{"target":{"file":"src/nvhttp.cpp","function":"clientchallenge"},"deprecated":false,"digest":{"function_hash":"19570670421250229369263525966128801134","length":1172},"id":"CVE-2024-51738-e538e4bb","signature_type":"Function","signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/89f097ae65277d42b5d40163d09d92e412e6d7dd"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}