{"id":"CVE-2025-53096","summary":"Sunshine clickjacking in the UI leads to unauthorized actions being performed","details":"Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks. This vulnerability allows an attacker to embed the Sunshine interface within a malicious website using an invisible or disguised iframe. If a user is tricked into interacting (one or multiple clicks) with the malicious page while authenticated, they may unknowingly perform actions within the Sunshine application without their consent. This issue has been patched in version 2025.628.4510.","aliases":["GHSA-x97g-h2vp-g2c5"],"modified":"2026-08-12T15:13:58.801699Z","published":"2025-07-01T01:33:01.336Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-1021"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53096.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53096.json"},{"type":"ADVISORY","url":"https://github.com/LizardByte/Sunshine/security/advisories/GHSA-x97g-h2vp-g2c5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53096"},{"type":"FIX","url":"https://github.com/LizardByte/Sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/lizardbyte/sunshine","events":[{"introduced":"0"},{"fixed":"65f14e1003f831e776c170621bd06d8292f65155"},{"fixed":"2f27a57d01911436017f87bf08b9e36dcfaa86cc"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2025.628.4510"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:lizardbyte:sunshine:*:*:*:*:*:*:*:*"}}],"versions":["v2025.122.141614","v2025.118.151840","v0.11.1","v0.11.0","v0.10.0","v0.9.0","v0.8.0","v0.4.0","v0.3.1","v0.3.0","v0.2.0","v0.1.1","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53096.json","vanir_signatures_modified":"2026-08-12T15:13:58Z","vanir_signatures":[{"id":"CVE-2025-53096-0a75c25b","signature_type":"Function","signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc","target":{"file":"src/confighttp.cpp","function":"getIndexPage"},"deprecated":false,"digest":{"length":306,"function_hash":"307887161629184574010515726156724406604"}},{"id":"CVE-2025-53096-0a7e8465","signature_type":"Function","signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc","target":{"file":"src/confighttp.cpp","function":"getFaviconImage"},"deprecated":false,"digest":{"function_hash":"314303817524968373118018800451957206877","length":281}},{"deprecated":false,"digest":{"function_hash":"14355825628495035334775524576883802025","length":384},"id":"CVE-2025-53096-2736d004","signature_type":"Function","signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc","target":{"function":"getAppsPage","file":"src/confighttp.cpp"}},{"signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc","target":{"file":"src/confighttp.cpp","function":"getSunshineLogoImage"},"deprecated":false,"digest":{"length":286,"function_hash":"222308005601620236216661897543849029807"},"id":"CVE-2025-53096-41b3a8f5","signature_type":"Function"},{"id":"CVE-2025-53096-44ce8596","signature_type":"Function","signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc","target":{"file":"src/confighttp.cpp","function":"getLogs"},"deprecated":false,"digest":{"length":337,"function_hash":"48709012949249973671287429677033260330"}},{"deprecated":false,"digest":{"function_hash":"220340785367668422024546706773841120847","length":625},"id":"CVE-2025-53096-53471bfe","signature_type":"Function","signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc","target":{"file":"src/confighttp.cpp","function":"send_unauthorized"}},{"signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc","target":{"function":"getWelcomePage","file":"src/confighttp.cpp"},"deprecated":false,"digest":{"function_hash":"85729931551301019444308250468963109751","length":358},"id":"CVE-2025-53096-63dfe4af","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc","target":{"function":"getNodeModules","file":"src/confighttp.cpp"},"deprecated":false,"digest":{"function_hash":"296978483156103058110086089188244102225","length":856},"id":"CVE-2025-53096-6476bd97"},{"target":{"file":"src/config.cpp"},"deprecated":false,"digest":{"line_hashes":["212956361864509626197879692058320906524","184840781174164536877521092334400672444","283106148898810440707172633955193446049","268925405016830700229153979821007473362","255616432110605973807457280840205954922","203215498917427026273234561746737700266","240605006573948468832353187021843097117","213073478700809629252658669702218518016"],"threshold":0.9},"id":"CVE-2025-53096-6ba58442","signature_type":"Line","signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/65f14e1003f831e776c170621bd06d8292f65155"},{"digest":{"function_hash":"271062351595603445580834449591339135154","length":309},"id":"CVE-2025-53096-6e7ae9f6","signature_type":"Function","signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc","target":{"function":"getPasswordPage","file":"src/confighttp.cpp"},"deprecated":false},{"source":"https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc","target":{"file":"src/confighttp.cpp"},"deprecated":false,"digest":{"line_hashes":["33871793288061329737392741853283924444","252846434665342647694603662144469974808","163884126042056836626778882513097327497","167105628155519988263369205177018766278","202638423257077544120596140740205732529","104707378506258883745099694410139962420","65085150207592838153365746935255523165","323008308484771542003313366138493700027","335283987084498083699552916709254572311","156571091424311835532684389147333252125","197505119424121057544777119105376594559","81374679633622654027899035412627239919","176432271101021762006605601331251239678","152667714300677252010733350646229300357","340237815480013885304551670643483370712","223109244952140978582746288834063391831","185331558029844238233133894906968256472","152667714300677252010733350646229300357","168004965040173550165557761777835647607","249498436542669873685795360312177350820","249499821854136067730811834235942733967","255535139141249080292502858997004735155","199865549825424328485499627257865333869","126452327578283462349021263509396533109","203508168655254535602527286542232034560","255535139141249080292502858997004735155","11522240557469402338856670494658395996","66341254861653660365442189794988092185","231306966905734335482944539735954370865","274779812910695997101835310283631348412","217614721083497319660410027684698243214","150251511097082289947929349408780507854","254926965185053326536047619336201614237","255535139141249080292502858997004735155","268161419077160276799218279616664448070","267408494660473626488054783874846538808","187349394411345147486946147349312320404","255535139141249080292502858997004735155","134001437882453708350341224398774557094","230150838764018127326267670275682061032","77489054693331574457495103832768046383","255535139141249080292502858997004735155","24857526036671392042305427131393594585","274177085799330491251318727179363772346","314121537862882497957680202718622747589","255535139141249080292502858997004735155","185578857057909666282492497840066352169","61888447471180117447816347095241615702","25752916461299816200995367548952750397","255535139141249080292502858997004735155","247926690245087497543494752907601651665","144109293438614607204961307042245736830","90700606434194799096714294461664399001","8019946001928036064669295053399779416","102178604666720162928975568409831281840","32664395350982822926153326672750532253","116257717886105197980576760090887370697","282954582877720579311215918976964085833","233459797659614235270893608191994005514","41337058280623982354914993009593877215","268260107053341189530104997560848305297","198762305548062513253913719298971618166","199915328290544128149693414932888752641","173975464691948711209753341238606565868","123487086182169734540819802706192628073","28617667395217020217496550297541156513","303428947035308491598555738953090059568"],"threshold":0.9},"id":"CVE-2025-53096-74c4ddd8","signature_type":"Line","signature_version":"v1"},{"target":{"file":"src/confighttp.cpp","function":"getClientsPage"},"deprecated":false,"digest":{"function_hash":"113386582048496834057658916124541506770","length":308},"id":"CVE-2025-53096-7dda1bc6","signature_type":"Function","signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc"},{"signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc","target":{"file":"src/confighttp.cpp","function":"getTroubleshootingPage"},"deprecated":false,"digest":{"function_hash":"228133322866018052497835077262186982164","length":316},"id":"CVE-2025-53096-966d43da","signature_type":"Function"},{"target":{"file":"src/confighttp.cpp","function":"send_redirect"},"deprecated":false,"digest":{"function_hash":"125794108751554192834838507921425858078","length":403},"id":"CVE-2025-53096-af3e1c74","signature_type":"Function","signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc"},{"id":"CVE-2025-53096-c209f956","signature_type":"Function","signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc","target":{"file":"src/confighttp.cpp","function":"getPinPage"},"deprecated":false,"digest":{"function_hash":"133890633404785497092357761764802643546","length":304}},{"deprecated":false,"digest":{"function_hash":"27472195915035619764513097687906023258","length":168},"id":"CVE-2025-53096-c881e38d","signature_type":"Function","signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc","target":{"file":"src/confighttp.cpp","function":"send_response"}},{"deprecated":false,"digest":{"function_hash":"310379448733369194027057397857328201308","length":307},"id":"CVE-2025-53096-d2c91d3a","signature_type":"Function","signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc","target":{"file":"src/confighttp.cpp","function":"getConfigPage"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"}]}