CVE-2026-45327 TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection
Unauthenticated attackers can inject unauthorized streams into TinyIce due to missing authentication on the WebRTC ingest endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45327?
CVE-2026-45327 is a high-severity missing authorization vulnerability in DatanoiseTV tinyice, published on 5 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token.
Weakness: CWE-306
Which versions are affected by CVE-2026-45327?
3 open source packages ship an affected version, including github.com/DatanoiseTV/tinyice.
| Package | Affected | Fixed in |
|---|---|---|
github.com/DatanoiseTV/tinyice Go | From 0.8.95 | None |
github.com/DatanoiseTV/tinyice Go | From 0.8.95 | 2.5.0 |
github.com/DatanoiseTV/tinyice Go | From 0.8.95 | 2.5.0 |
How do I fix CVE-2026-45327?
Upgrade github.com/DatanoiseTV/tinyice to 2.5.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-45327 being exploited?
There is no known exploitation of CVE-2026-45327 in the wild and no public exploit code.
Sources
Also known as GHSA-p7c4-8x34-8j8f, GO-2026-5534.