Clients removed during unpairing process may regain access if Sunshine was not restarted
Package
sunshine
Affected versions
>= 0.10.0, < 0.23.0
Patched versions
v0.23.0
Description
Credits
-
MatheusJCastro Reporter
-
ReenigneArcher Remediation developer
Impact
After unpairing all devices in the web UI interface and then pairing only one device, all of the previously devices will be temporarily paired. Once Sunshine is restarted only the clients that were re-paired would have access, as intended.
Patches
v0.23.0
Workarounds
Restarting Sunshine after unpairing all devices prevents the vulnerability.
References