CVE-2026-45327

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45327
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45327.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45327
Aliases
Downstream
Related
Published
2026-06-05T16:57:52.612Z
Modified
2026-08-04T11:30:48.458289063Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L CVSS Calculator
Summary
TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection
Details

TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a ?password= query parameter, comparing the supplied password against the per-mount source password (or the default_source_password fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in disabled_mounts. The same release also tightens an adjacent endpoint, POST /admin/golive/chunk, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token.

Database specific 
{
    "cwe_ids": [
        "CWE-306"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45327.json"
}
References

Affected packages

Git / github.com/datanoisetv/tinyice

Affected ranges

Type
GIT
Repo
https://github.com/datanoisetv/tinyice
Events
Introduced
e2b60d6d74a1c24c1e6a768e517417efc1b0a6b4
Fixed
35f32a069622a6f91953b30ca1f902a6869071bc
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0.8.95"
        },
        {
            "fixed": "2.5.0"
        }
    ]
}

Affected versions

v0.*
v0.10.0
v0.10.1
v0.10.2
v0.10.3
v0.11.0
v0.8.95
v0.9.10
v0.9.4
v0.9.5
v0.9.6
v0.9.7
v0.9.8
v0.9.9
v2.*
v2.0.0
v2.0.0-beta.1
v2.0.0-beta.2
v2.0.0-beta.3
v2.0.0-beta.4
v2.0.0-beta.5
v2.0.0-beta.6
v2.0.0-beta.7
v2.0.0-beta.8
v2.1.0
v2.2.0
v2.2.1
v2.2.2
v2.3.0
v2.3.1
v2.3.2
v2.4.0
v2.4.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45327.json"