CVE-2024-51738

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order and is thereby vulnerable to a MITM attack, potentially allowing an unauthenticated attacker to pair a client by hijacking a legitimate pairing attempt. This bug may also be used by a remote attacker to crash Sunshine. This vulnerability is fixed in 2025.118.151840.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-305 CWE-476 CWE-841

Affected software

No affected versions have been published.

Timeline

Published: Jan 20, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-517395.3Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier CVE-2024-51745.3A flaw in Gliffy results in broken authentication through the reset functionality of the application.CVE-2024-517408.8Combodo iTop is a simple, web based IT Service Management tool. This vulnerability can be used to create HTTP requests on behalf of the serv CVE-2024-517414.4Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL se CVE-2024-517438.8MarkUs is a web application for the submission and grading of student assignments. In versions prior to 2.4.8, an arbitrary file write vulne CVE-2024-517443.1golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation CVE-2024-5174510.0Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special devi CVE-2024-517461.8Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry t CVE-2024-517477.2Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can read and delete arbitrar CVE-2024-517487.2Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can run arbitrary php code o CVE-2024-517493.5Element is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if th CVE-2024-517505.0Element is a Matrix web client built using the Matrix React SDK. A malicious homeserver can send invalid messages over federation which can