Vulnerability-Lookup

CVE-2026-45327 (GCVE-0-2026-45327)

Vulnerability from cvelistv5 – Published: 2026-06-05 16:57 – Updated: 2026-06-05 19:07

Title

TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection

Summary

TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-05 19:07 UTC

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7763 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/DatanoiseTV/tinyice/security/a…	x_refsource_CONFIRM
https://github.com/DatanoiseTV/tinyice/commit/8067d6b	x_refsource_MISC
https://github.com/DatanoiseTV/tinyice/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
DatanoiseTV	tinyice	Affected: >= 0.8.95, < 2.5.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45327",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-05T19:07:18.738670Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-05T19:07:26.982Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "tinyice",
          "vendor": "DatanoiseTV",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.8.95, \u003c 2.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user\u0027s per-mount access nor check the CSRF token."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T16:57:52.612Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f"
        },
        {
          "name": "https://github.com/DatanoiseTV/tinyice/commit/8067d6b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DatanoiseTV/tinyice/commit/8067d6b"
        },
        {
          "name": "https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-p7c4-8x34-8j8f",
        "discovery": "UNKNOWN"
      },
      "title": "TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45327",
    "datePublished": "2026-06-05T16:57:52.612Z",
    "dateReserved": "2026-05-11T20:50:30.539Z",
    "dateUpdated": "2026-06-05T19:07:26.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45327",
      "date": "2026-11-11",
      "epss": "0.00357",
      "percentile": "0.29769"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "tinyice",
                "vendor": "DatanoiseTV",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 0.8.95, \u003c 2.5.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user\u0027s per-mount access nor check the CSRF token."
          },
          {
            "lang": "es",
            "value": "TinyIce es un servidor de streaming para audio y video. En las versiones 0.8.95 a 2.4.1, la falta de autenticaci\u00f3n en el endpoint de ingesta de WebRTC permite la inyecci\u00f3n de streams no autenticados. La versi\u00f3n 2.5.0 soluciona el problema al requerir autenticaci\u00f3n HTTP Basic o un par\u00e1metro de consulta \u2019?password=\u2019, comparando la contrase\u00f1a proporcionada con la contrase\u00f1a de origen por punto de montaje (o el valor de respaldo \u2019default_source_password\u2019) usando bcrypt, integr\u00e1ndose en el limitador de velocidad de IP de fuerza bruta existente (5 intentos fallidos por IP en 15 minutos activan un bloqueo), y rechazando las solicitudes para puntos de montaje en \u2019disabled_mounts\u2019. La misma versi\u00f3n tambi\u00e9n refuerza un endpoint adyacente, \u2019POST /admin/golive/chunk\u2019, que anteriormente requer\u00eda autenticaci\u00f3n de sesi\u00f3n pero no verificaba el acceso por punto de montaje del usuario de la sesi\u00f3n ni comprobaba el token CSRF."
          }
        ],
        "id": "CVE-2026-45327",
        "lastModified": "2026-10-25T23:10:00.167",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-45327",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-05T19:07:18.738670Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-05T18:17:27.220",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/DatanoiseTV/tinyice/commit/8067d6b"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-306"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-06-06T18:43:16+00:00",
      "cve": "CVE-2026-45327",
      "id": "CVE-2026-45327",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45327.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-45327",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-05T19:07:18.738670Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-05T19:07:22.107Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "tinyice",
              "vendor": "DatanoiseTV",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 0.8.95, \u003c 2.5.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user\u0027s per-mount access nor check the CSRF token."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-306",
                  "description": "CWE-306: Missing Authentication for Critical Function",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-05T16:57:52.612Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f"
            },
            {
              "name": "https://github.com/DatanoiseTV/tinyice/commit/8067d6b",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/DatanoiseTV/tinyice/commit/8067d6b"
            },
            {
              "name": "https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0"
            }
          ],
          "source": {
            "advisory": "GHSA-p7c4-8x34-8j8f",
            "discovery": "UNKNOWN"
          },
          "title": "TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-45327",
        "datePublished": "2026-06-05T16:57:52.612Z",
        "dateReserved": "2026-05-11T20:50:30.539Z",
        "dateUpdated": "2026-06-05T19:07:26.982Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-45327

Vulnerability from fkie_nvd - Published: 2026-06-05 18:17 - Updated: 2026-10-25 23:10

Severity

8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/DatanoiseTV/tinyice/commit/8067d6b
	security-advisories@github.com	https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0
	security-advisories@github.com	https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "tinyice",
          "vendor": "DatanoiseTV",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.8.95, \u003c 2.5.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user\u0027s per-mount access nor check the CSRF token."
    },
    {
      "lang": "es",
      "value": "TinyIce es un servidor de streaming para audio y video. En las versiones 0.8.95 a 2.4.1, la falta de autenticaci\u00f3n en el endpoint de ingesta de WebRTC permite la inyecci\u00f3n de streams no autenticados. La versi\u00f3n 2.5.0 soluciona el problema al requerir autenticaci\u00f3n HTTP Basic o un par\u00e1metro de consulta \u2019?password=\u2019, comparando la contrase\u00f1a proporcionada con la contrase\u00f1a de origen por punto de montaje (o el valor de respaldo \u2019default_source_password\u2019) usando bcrypt, integr\u00e1ndose en el limitador de velocidad de IP de fuerza bruta existente (5 intentos fallidos por IP en 15 minutos activan un bloqueo), y rechazando las solicitudes para puntos de montaje en \u2019disabled_mounts\u2019. La misma versi\u00f3n tambi\u00e9n refuerza un endpoint adyacente, \u2019POST /admin/golive/chunk\u2019, que anteriormente requer\u00eda autenticaci\u00f3n de sesi\u00f3n pero no verificaba el acceso por punto de montaje del usuario de la sesi\u00f3n ni comprobaba el token CSRF."
    }
  ],
  "id": "CVE-2026-45327",
  "lastModified": "2026-10-25T23:10:00.167",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45327",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-05T19:07:18.738670Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-05T18:17:27.220",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/DatanoiseTV/tinyice/commit/8067d6b"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-P7C4-8X34-8J8F

Vulnerability from github – Published: 2026-05-18 17:20 – Updated: 2026-06-09 11:56

Summary

TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection

Details

Title

Missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection in TinyIce

Ecosystem / Package

Ecosystem: Go (or "Other" — TinyIce is shipped as a Go binary, not a Go module published to a registry)
Package name: github.com/DatanoiseTV/tinyice

Affected versions

>= 0.8.95, <= 2.4.1

(Introduced 2026-02-21 in commit e2b60d6 — "debug: add Go Live connection tracing and backend data flow logging" — when handleWebRTCSourceOffer was registered at /webrtc/source-offer without an authentication check. Every tagged release from v0.8.95 through v2.4.1 ships the vulnerable handler.)

Patched versions

>= 2.5.0

Severity

CVSS 3.1 base score: 7.4 (High)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
CWE: CWE-306: Missing Authentication for Critical Function

Description

TinyIce's WebRTC source-ingest HTTP endpoint, POST /webrtc/source-offer?mount=<mount>, accepted any inbound WebRTC SDP offer with no authentication check. The handler routed the offer to WebRTCManager.HandleSourceOffer, which then accepted whatever audio/video tracks the peer published and broadcast them on the named mount as if they were the legitimate source.

The other ingest paths (POST /<mount> over HTTP/1 with the icecast SOURCE / PUT verb, RTMP, SRT) all require the per-mount source password, falling back to default_source_password from the config. The WebRTC ingest path didn't.

Impact

A network attacker who can reach the TinyIce HTTP port can:

Identify a target mount (mount names are public — they appear in the directory listing, the player URL, and the YP listing).
Negotiate a WebRTC peer connection with the server.
Publish arbitrary Opus / H.264 to that mount.
Have it broadcast to every listener on the mount.

This is a high-integrity-impact issue: an attacker can replace a radio's broadcast with their own audio (silence, noise, malicious content, branded competitor content, etc.). Listeners hear what the attacker sends, not what the legitimate publisher intended.

The legitimate publisher can re-establish their session — TinyIce's source-takeover handshake gives the new offer priority once it arrives, with a 3-second drain of the previous pump goroutine — but the attacker can in principle re-connect immediately after, producing a sustained broadcast hijack until the operator manually intervenes (block at firewall, rotate source passwords once the patch is applied, restart the service).

There is no direct confidentiality impact through this endpoint: the attacker doesn't gain access to listener data or other mounts' content.

Workarounds

If users cannot upgrade immediately:

Recommended: block POST /webrtc/source-offer at the reverse proxy in front of TinyIce. The endpoint has no production use case for clients outside the operator's own administration — disabling it loses no functionality unless the consuming application specifically use the browser-based "go-live" feature.
Restrict TinyIce's HTTP port to a trusted network (VPN, internal LAN). Listener access can still be served via a separately-firewalled CDN if the application needs public listening.

Detection

To check whether an application's deployment is exposed, run from outside the network:

curl -i -X POST 'https://your-tinyice-host/webrtc/source-offer?mount=/anymount' \
  -H 'Content-Type: application/json' \
  -d '{"type":"offer","sdp":"v=0\r\n"}'

If the response is 400 Bad Request with a JSON body containing an SDP-parsing error from pion/webrtc, a consuming application is vulnerable — the server tried to negotiate the (malformed) offer without asking for credentials.
If the response is 401 Unauthorized (Basic auth challenge), the consuming application has been patched.

Authenticated log lines on a patched server will look like:

WARN  Authentication failed for user 'webrtc-source' from 1.2.3.4: invalid source password

Fix

Upstream commit: 8067d6b "fix(api): require source password on /webrtc/source-offer + CSRF/access on /go-live-chunk".

The handler now:

Requires either HTTP Basic auth or a ?password= query parameter.
Compares the supplied password against the per-mount source password (or the default_source_password fallback) using bcrypt.
Hooks into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout).
Rejects requests for mounts in disabled_mounts.

The same release also tightens an adjacent endpoint, POST /admin/golive/chunk, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token.

Timeline

2026-02-21 — Vulnerable handler introduced (e2b60d6).
2026-05-09 — Vulnerability identified during a maintainer-led audit.
2026-05-09 — Patched in commit 8067d6b, released as v2.5.0.
2026-05-09 — GitHub Security Advisory published, CVE assigned.

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.4.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/DatanoiseTV/tinyice"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.8.95"
            },
            {
              "fixed": "2.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45327"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-18T17:20:17Z",
    "nvd_published_at": "2026-06-05T18:17:27Z",
    "severity": "HIGH"
  },
  "details": "## Title\n\nMissing authentication on WebRTC ingest endpoint allows unauthenticated stream injection in TinyIce\n\n## Ecosystem / Package\n\n- **Ecosystem:** `Go` (or \"Other\" \u2014 TinyIce is shipped as a Go binary, not a Go module published to a registry)\n- **Package name:** `github.com/DatanoiseTV/tinyice`\n\n## Affected versions\n\n```\n\u003e= 0.8.95, \u003c= 2.4.1\n```\n\n(Introduced 2026-02-21 in commit `e2b60d6` \u2014 \"debug: add Go Live connection tracing and backend data flow logging\" \u2014 when `handleWebRTCSourceOffer` was registered at `/webrtc/source-offer` without an authentication check. Every tagged release from `v0.8.95` through `v2.4.1` ships the vulnerable handler.)\n\n## Patched versions\n\n```\n\u003e= 2.5.0\n```\n\n## Severity\n\n- **CVSS 3.1 base score:** 7.4 (High)\n- **CVSS vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L`\n- **CWE:** [CWE-306: Missing Authentication for Critical Function](https://cwe.mitre.org/data/definitions/306.html)\n\n## Description\n\nTinyIce\u0027s WebRTC source-ingest HTTP endpoint, `POST /webrtc/source-offer?mount=\u003cmount\u003e`, accepted any inbound WebRTC SDP offer with no authentication check. The handler routed the offer to `WebRTCManager.HandleSourceOffer`, which then accepted whatever audio/video tracks the peer published and broadcast them on the named mount as if they were the legitimate source.\n\nThe other ingest paths (`POST /\u003cmount\u003e` over HTTP/1 with the icecast `SOURCE` / `PUT` verb, RTMP, SRT) all require the per-mount source password, falling back to `default_source_password` from the config. The WebRTC ingest path didn\u0027t.\n\n## Impact\n\nA network attacker who can reach the TinyIce HTTP port can:\n\n1. Identify a target mount (mount names are public \u2014 they appear in the directory listing, the player URL, and the YP listing).\n2. Negotiate a WebRTC peer connection with the server.\n3. Publish arbitrary Opus / H.264 to that mount.\n4. Have it broadcast to every listener on the mount.\n\nThis is a high-integrity-impact issue: an attacker can replace a radio\u0027s broadcast with their own audio (silence, noise, malicious content, branded competitor content, etc.). Listeners hear what the attacker sends, not what the legitimate publisher intended.\n\nThe legitimate publisher can re-establish their session \u2014 TinyIce\u0027s source-takeover handshake gives the new offer priority once it arrives, with a 3-second drain of the previous pump goroutine \u2014 but the attacker can in principle re-connect immediately after, producing a sustained broadcast hijack until the operator manually intervenes (block at firewall, rotate source passwords once the patch is applied, restart the service).\n\nThere is no direct confidentiality impact through this endpoint: the attacker doesn\u0027t gain access to listener data or other mounts\u0027 content.\n\n## Workarounds\n\nIf users cannot upgrade immediately:\n\n- **Recommended:** block `POST /webrtc/source-offer` at the reverse proxy in front of TinyIce. The endpoint has no production use case for clients outside the operator\u0027s own administration \u2014 disabling it loses no functionality unless the consuming application specifically use the browser-based \"go-live\" feature.\n- Restrict TinyIce\u0027s HTTP port to a trusted network (VPN, internal LAN). Listener access can still be served via a separately-firewalled CDN if the application needs public listening.\n\n## Detection\n\nTo check whether an application\u0027s deployment is exposed, run from outside the network:\n\n```\ncurl -i -X POST \u0027https://your-tinyice-host/webrtc/source-offer?mount=/anymount\u0027 \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\"type\":\"offer\",\"sdp\":\"v=0\\r\\n\"}\u0027\n```\n\n- If the response is `400 Bad Request` with a JSON body containing an SDP-parsing error from `pion/webrtc`, **a consuming application is vulnerable** \u2014 the server tried to negotiate the (malformed) offer without asking for credentials.\n- If the response is `401 Unauthorized` (Basic auth challenge), the consuming application has been patched.\n\nAuthenticated log lines on a patched server will look like:\n\n```\nWARN  Authentication failed for user \u0027webrtc-source\u0027 from 1.2.3.4: invalid source password\n```\n\n## Fix\n\nUpstream commit: [`8067d6b`](https://github.com/DatanoiseTV/tinyice/commit/8067d6b) \"fix(api): require source password on /webrtc/source-offer + CSRF/access on /go-live-chunk\".\n\nThe handler now:\n\n1. Requires either HTTP Basic auth or a `?password=` query parameter.\n2. Compares the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt.\n3. Hooks into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout).\n4. Rejects requests for mounts in `disabled_mounts`.\n\nThe same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user\u0027s per-mount access nor check the CSRF token.\n\n## Timeline\n\n- 2026-02-21 \u2014 Vulnerable handler introduced (`e2b60d6`).\n- 2026-05-09 \u2014 Vulnerability identified during a maintainer-led audit.\n- 2026-05-09 \u2014 Patched in commit `8067d6b`, released as `v2.5.0`.\n- 2026-05-09 \u2014 GitHub Security Advisory published, CVE assigned.",
  "id": "GHSA-p7c4-8x34-8j8f",
  "modified": "2026-06-09T11:56:10Z",
  "published": "2026-05-18T17:20:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45327"
    },
    {
      "type": "WEB",
      "url": "https://github.com/DatanoiseTV/tinyice/commit/8067d6b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/DatanoiseTV/tinyice"
    },
    {
      "type": "WEB",
      "url": "https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-45327 (GCVE-0-2026-45327)

FKIE_CVE-2026-45327

GHSA-P7C4-8X34-8J8F

Title

Ecosystem / Package

Affected versions

Patched versions

Severity

Description

Impact

Workarounds

Detection

Fix

Timeline

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour