CVE-2026-45327

TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection

Published Jun 5, 2026 CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Description

TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token.

Analysis

Technical impact

TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1 a missing authentication check on the WebRTC ingest endpoint allows any user to submit a stream to any mount point without credentials. An attacker could inject malicious or unwanted content, potentially affecting streaming integrity, misrepresenting broadcast material, or overwhelming the server with spoofed streams, which can degrade service availability.

Affected Systems

The vulnerability affects deployments of TinyIce version 0.8.95 up to 2.4.1 from the vendor DatanoiseTV. Any installation that has the ready‑to‑use WebRTC ingest endpoint enabled and no additional authentication will be susceptible. Version 2.5.0 and later include mandatory authentication via HTTP Basic or a password query string and enforce bcrypt verification along with the existing brute‑force IP rate limiter.

Risk and Exploitability

The CVSS base score is 8.2, indicating high severity. Because no EPSS score is reported, the current likelihood of exploitation cannot be assessed, and the vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the missing authentication over the network, assuming unrestricted connectivity to the ingest port, and the patch relies on the installation of v2.5.0 or later to mitigate the flaw.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

DatanoiseTV

tinyice

affected

Version	Status	Constraints
`>= 0.8.95, < 2.5.0`	affected	—

No data.

Vendor Product Versions

Datanoisetv

Tinyice

Version	Status	Scheme	Platform
`[0.8.95,2.5.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade TinyIce to version 2.5.0 or later to enforce authentication on the WebRTC ingest endpoint and address related admin endpoint weaknesses.
After the upgrade, verify that each mount’s source password or the default_source_password is set to a strong unique value and that disabled_mounts is correctly configured to prevent unintended streams.
Restrict network access to the ingest endpoint using firewalls or access controls, or disable WebRTC ingest for mounts that do not require public streaming.

Generated by OpenCVE AI on June 5, 2026 at 18:36 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-p7c4-8x34-8j8f	TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.357% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/DatanoiseTV/tinyice/commit/8067d6b
https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0
https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f

History

Jun 7, 2026 11:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Datanoisetv Datanoisetv tinyice
Vendors & Products		Datanoisetv Datanoisetv tinyice

Jun 5, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 5, 2026 5:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token.
Title		TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection
Weaknesses		CWE-306
References		https://github.com/DatanoiseTV/tinyice/commit/8067d6b https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0 https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L'}`