CVE-2024-51738CWE-305CWE-476CWE-841

Sunshine improperly enforces pairing protocol request order

High · published January 20, 2025

CVSS v4.0
7.7
EPSS
1%
Percentile
47.1
In the wild
Unconfirmed
What it is

Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order and is thereby vulnerable to a MITM attack, potentially allowing an unauthenticated attacker to pair a client by hijacking a legitimate pairing attempt. This bug may also be used by a remote attacker to crash Sunshine. This vulnerability is fixed in 2025.118.151840.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00583 · 47.1th percentile
Weaknesses
CWE-305 · Authentication Bypass by Primary Weakness; CWE-476 · NULL Pointer Dereference; CWE-841 · Improper Enforcement of Behavioral Workflow
Published
2025-01-20T15:26Z
EPSS history
Timeline
  • 20 JAN 15:26Z
    Sunshine improperly enforces pairing protocol request order
    cvelistv5