CVE-2026-45327 Details
Description
TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token.
A vulnerability in TinyIce versions 0.8.95 through 2.4.1 allows for unauthorized stream injection via the WebRTC ingest endpoint. The issue arises from a lack of authentication, which enables any network-reachable user to publish audio or video to a specified mount, disrupting the legitimate broadcast. This vulnerability was introduced in version 0.8.95 and patched in version 2.5.0, which added authentication requirements and tightened access controls on an adjacent endpoint.
Upgrade to TinyIce version 2.5.0 or later. After upgrading, rotate per-mount source passwords. If an immediate upgrade is not possible, block the '/webrtc/source-offer' endpoint at the reverse proxy or restrict TinyIce's HTTP port to a trusted network.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 5, 2026CISA-ADP
Assessed Jun 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/DatanoiseTV/tinyice/commit/8067d6b | [email protected] | Source CodeVendor |
| https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0 | [email protected] | Release NotesVendor |
| https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DatanoiseTV TinyIce | >= 0.8.95, <= 2.4.1 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | New CVE Received | [email protected] |