CVE-2025-53096

Katalog CVE

CVSS 6.1 · Medium EPSS 0,24%

Kerentanan Improper Restriction of Rendered UI Layers or Frames pada lizardbyte sunshine. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks. This vulnerability allows an attacker to embed the Sunshine interface within a malicious website using an invisible or disguised iframe. If a user is tricked into interacting (one or multiple clicks) with the malicious page while authenticated, they may unknowingly perform actions within the Sunshine application without their consent. This issue has been patched in version 2025.628.4510.

Rincian

Terbit di NVD

1 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1021: Improper Restriction of Rendered UI Layers or Frames

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 14,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/LizardByte/Sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86cc patch
• https://github.com/LizardByte/Sunshine/security/advisories/GHSA-x97g-h2vp-g2c5 advisory pihak ketiga