Vulnerability Description
TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/DatanoiseTV/tinyice/commit/8067d6b
- https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0
- https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f
FAQ
What is CVE-2026-45327?
CVE-2026-45327 is a vulnerability with a CVSS score of 8.2 (HIGH). TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the i...
How severe is CVE-2026-45327?
CVE-2026-45327 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-45327?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.