CVE-2025-53096

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks. This vulnerability allows an attacker to embed the Sunshine interface within a malicious website using an invisible or disguised iframe. If a user is tricked into interacting (one or multiple clicks) with the malicious page while authenticated, they may unknowingly perform actions within the Sunshine application without their consent. This issue has been patched in version 2025.628.4510.

• CWE-1021

• https://github.com/LizardByte/Sunshine/commit/2f27a57d01911436017f87bf08b9e36dcfaa86ccPatch
• https://github.com/LizardByte/Sunshine/security/advisories/GHSA-x97g-h2vp-g2c5Third Party Advisory

Published

Jul 1, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-5309The chat feature within Remote Support (RS) and Privileged R…9.8
• CVE-2025-53091WeGIA is an open source web manager with a focus on the Port…9.8
• CVE-2025-53092Strapi is an open source headless content management system.…6.5
• CVE-2025-53093TabberNeue is a MediaWiki extension that allows the wiki to …8.6
• CVE-2025-53094ESPAsyncWebServer is an asynchronous HTTP and WebSocket serv…8.7
• CVE-2025-53095Sunshine is a self-hosted game stream host for Moonlight. Pr…8.8
• CVE-2025-53097Roo Code is an AI-powered autonomous coding agent. Prior to …7.5
• CVE-2025-53098Roo Code is an AI-powered autonomous coding agent. The proje…8.1
• CVE-2025-53099Sentry is a developer-first error tracking and performance m…7.5
• CVE-2025-5310Dover Fueling Solutions ProGauge MagLink LX Consoles expose …9.8
• CVE-2025-53100RestDB's Codehooks.io MCP Server is an MCP server on the Cod…8.6
• CVE-2025-53101ImageMagick is free and open-source software used for editin…9.8