TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1 a missing authentication check on the WebRTC ingest endpoint allows any user to submit a stream to any mount point without credentials. An attacker could inject malicious or unwanted content, potentially affecting streaming integrity, misrepresenting broadcast material, or overwhelming the server with spoofed streams, which can degrade service availability.

The vulnerability affects deployments of TinyIce version 0.8.95 up to 2.4.1 from the vendor DatanoiseTV. Any installation that has the ready‑to‑use WebRTC ingest endpoint enabled and no additional authentication will be susceptible. Version 2.5.0 and later include mandatory authentication via HTTP Basic or a password query string and enforce bcrypt verification along with the existing brute‑force IP rate limiter.

The CVSS base score is 8.2, indicating high severity. Because no EPSS score is reported, the current likelihood of exploitation cannot be assessed, and the vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the missing authentication over the network, assuming unrestricted connectivity to the ingest port, and the patch relies on the installation of v2.5.0 or later to mitigate the flaw.