CVE-2025-53096CWE-1021

Sunshine clickjacking in the UI leads to unauthorized actions being performed

Medium · published July 1, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
14.5
In the wild
Unconfirmed
What it is

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks. This vulnerability allows an attacker to embed the Sunshine interface within a malicious website using an invisible or disguised iframe. If a user is tricked into interacting (one or multiple clicks) with the malicious page while authenticated, they may unknowingly perform actions within the Sunshine application without their consent. This issue has been patched in version 2025.628.4510.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00242 · 14.5th percentile
Weakness
CWE-1021 · Improper Restriction of Rendered UI Layers or Frames
Published
2025-07-01T01:33Z
EPSS history
Timeline
  • 01 JUL 01:33Z
    Sunshine clickjacking in the UI leads to unauthorized actions being performed
    cvelistv5