CVE-2025-53096: Lizardbyte Sunshine CSRF Vulnerability

CVE-2025-53096 Overview

CVE-2025-53096 affects Sunshine, a self-hosted game stream host for Moonlight developed by LizardByte. Versions prior to 2025.628.4510 lack Clickjacking protection in the web user interface. An attacker can embed the Sunshine interface within a malicious website using an invisible or disguised iframe. Authenticated users tricked into interacting with the malicious page may unknowingly perform actions in the Sunshine application. The issue maps to [CWE-1021] Improper Restriction of Rendered UI Layers or Frames. LizardByte patched the flaw in version 2025.628.4510.

Critical Impact
Authenticated Sunshine users can be coerced into executing unintended state-changing actions through iframe-based UI redressing attacks.

Affected Products

LizardByte Sunshine versions prior to 2025.628.4510
Self-hosted Sunshine web UI deployments exposed to browsers with active user sessions
All platforms running vulnerable Sunshine builds (Windows, Linux, macOS)

Discovery Timeline

2025-07-01 - CVE-2025-53096 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53096

Vulnerability Analysis

Sunshine's web UI ships without HTTP response headers that prevent framing by third-party origins. The application does not set an X-Frame-Options header, nor does it enforce a Content Security Policy (CSP) frame-ancestors directive. Browsers therefore permit any external site to load the Sunshine interface inside an <iframe>.

Attackers exploit this gap through UI redressing. A malicious page overlays the framed Sunshine UI beneath decoy content or renders it with zero opacity. When an authenticated victim clicks what appears to be an unrelated button, the click passes through to the hidden Sunshine control. Because the browser attaches the user's session cookies to the framed request, the action executes with full user privileges.

Exploitation requires user interaction and an active authenticated session, which is reflected in the attack scoring. Impact is limited to integrity and availability of Sunshine configuration and streaming state — no direct confidentiality loss occurs.

Root Cause

The root cause is missing frame-ancestor restrictions on responses served by the Sunshine web UI. Without X-Frame-Options: DENY, X-Frame-Options: SAMEORIGIN, or an equivalent CSP directive, browsers default to allowing cross-origin framing. The fix commit 2f27a57d adds the missing header enforcement.

Attack Vector

Exploitation is network-based and requires the victim to visit an attacker-controlled page while holding an authenticated Sunshine session in the same browser. The attacker crafts an HTML page containing an invisible iframe pointing at the target Sunshine instance, positions decoy elements over sensitive controls, and lures the victim into clicking. See the GitHub Security Advisory GHSA-x97g-h2vp-g2c5 for full details.

Detection Methods for CVE-2025-53096

Indicators of Compromise

Unexpected configuration changes, paired client additions, or streaming session initiations in Sunshine logs originating from legitimate user IPs
HTTP Referer headers on Sunshine web UI requests pointing to unfamiliar external origins
Sunshine web responses missing X-Frame-Options or CSP frame-ancestors headers when inspected via browser developer tools

Detection Strategies

Audit Sunshine access logs for state-changing POST requests correlated with cross-origin Referer values
Scan Sunshine HTTP responses to confirm frame-protection headers are present after patching
Review browser history and endpoint telemetry for user visits to suspicious pages preceding unexpected Sunshine activity

Monitoring Recommendations

Alert on Sunshine configuration mutations occurring outside normal administrative workflows
Monitor endpoints runningسunshine for outbound connections to newly registered or low-reputation domains
Track Sunshine version strings across the fleet to identify hosts still running builds prior to 2025.628.4510

How to Mitigate CVE-2025-53096

Immediate Actions Required

Upgrade Sunshine to version 2025.628.4510 or later on all self-hosted instances
Restrict Sunshine web UI exposure to trusted networks or place it behind a reverse proxy with authentication controls
Instruct users to log out of the Sunshine web UI when not actively managing streams

Patch Information

LizardByte released the fix in Sunshine version 2025.628.4510. The corrective change is available in commit 2f27a57d01911436017f87bf08b9e36dcfaa86cc and documented in GHSA-x97g-h2vp-g2c5. Apply the update as the primary remediation.

Workarounds

Deploy a reverse proxy that injects X-Frame-Options: DENY and Content-Security-Policy: frame-ancestors 'none' on all Sunshine responses
Bind the Sunshine web UI to localhost or a management VLAN and require VPN access for administration
Use a dedicated browser profile for Sunshine administration to isolate session cookies from general browsing

bash

# Example reverse proxy header enforcement (nginx)
add_header X-Frame-Options "DENY" always;
add_header Content-Security-Policy "frame-ancestors 'none'" always;