CVE-2026-45327

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45327", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-11T20:50:30.539Z", "datePublished": "2026-06-05T16:57:52.612Z", "dateUpdated": "2026-06-05T19:07:26.982Z"}, "containers": {"cna": {"title": "TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f"}, {"name": "https://github.com/DatanoiseTV/tinyice/commit/8067d6b", "tags": ["x_refsource_MISC"], "url": "https://github.com/DatanoiseTV/tinyice/commit/8067d6b"}, {"name": "https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0"}], "affected": [{"vendor": "DatanoiseTV", "product": "tinyice", "versions": [{"version": ">= 0.8.95, < 2.5.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-05T16:57:52.612Z"}, "descriptions": [{"lang": "en", "value": "TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token."}], "source": {"advisory": "GHSA-p7c4-8x34-8j8f", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-05T19:07:18.738670Z", "id": "CVE-2026-45327", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-05T19:07:26.982Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45327", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-05T19:07:18.738670Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-05T19:07:22.107Z"}}], "cna": {"title": "TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection", "source": {"advisory": "GHSA-p7c4-8x34-8j8f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "DatanoiseTV", "product": "tinyice", "versions": [{"status": "affected", "version": ">= 0.8.95, < 2.5.0"}]}], "references": [{"url": "https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f", "name": "https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/DatanoiseTV/tinyice/commit/8067d6b", "name": "https://github.com/DatanoiseTV/tinyice/commit/8067d6b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0", "name": "https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-05T16:57:52.612Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45327", "state": "PUBLISHED", "dateUpdated": "2026-06-05T19:07:26.982Z", "dateReserved": "2026-05-11T20:50:30.539Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-05T16:57:52.612Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "tinyice", "vendor": "DatanoiseTV", "versions": [{"status": "affected", "version": ">= 0.8.95, < 2.5.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token."}, {"lang": "es", "value": "TinyIce es un servidor de streaming para audio y video. En las versiones 0.8.95 a 2.4.1, la falta de autenticaci\u00f3n en el endpoint de ingesta de WebRTC permite la inyecci\u00f3n de streams no autenticados. La versi\u00f3n 2.5.0 soluciona el problema al requerir autenticaci\u00f3n HTTP Basic o un par\u00e1metro de consulta \u2019?password=\u2019, comparando la contrase\u00f1a proporcionada con la contrase\u00f1a de origen por punto de montaje (o el valor de respaldo \u2019default_source_password\u2019) usando bcrypt, integr\u00e1ndose en el limitador de velocidad de IP de fuerza bruta existente (5 intentos fallidos por IP en 15 minutos activan un bloqueo), y rechazando las solicitudes para puntos de montaje en \u2019disabled_mounts\u2019. La misma versi\u00f3n tambi\u00e9n refuerza un endpoint adyacente, \u2019POST /admin/golive/chunk\u2019, que anteriormente requer\u00eda autenticaci\u00f3n de sesi\u00f3n pero no verificaba el acceso por punto de montaje del usuario de la sesi\u00f3n ni comprobaba el token CSRF."}], "id": "CVE-2026-45327", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45327", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-05T19:07:18.738670Z", "version": "2.0.3"}}]}, "published": "2026-06-05T18:17:27.220", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/DatanoiseTV/tinyice/commit/8067d6b"}, {"source": "security-advisories@github.com", "url": "https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.8.95,2.5.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "tinyice", "source": "cna", "vendor": "DatanoiseTV"}, "product": "tinyice", "vendor": "datanoisetv"}], "created": "2026-06-05T18:45:06.487191+00:00", "updated": "2026-06-07T11:16:16.318422+00:00", "vendors": ["datanoisetv", "datanoisetv$PRODUCT$tinyice"]}