VULNERABILITY INTELLIGENCE

CVE-2024-45407

CVSS score6.5 MEDIUM

EPSS probability0.34%

CISA KEVNot currently listed

Published2024-09-10

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Description

Sunshine is a self-hosted game stream host for Moonlight. Clients that experience a MITM attack during the pairing process may inadvertantly allow access to an unintended client rather than failing authentication due to a PIN validation error. The pairing attempt fails due to the incorrect PIN, but the certificate from the forged pairing attempt is incorrectly persisted prior to the completion of the pairing request. This allows access to the certificate belonging to the attacker.

Weakness classification

security-advisories@github.com: CWE-300
nvd@nist.gov: NVD-CWE-noinfo

Primary references

security-advisories@github.com — Patch
security-advisories@github.com — Patch
security-advisories@github.com — Exploit, Vendor Advisory