CVE-2026-45327

TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token.

• CWE-306

• https://github.com/DatanoiseTV/tinyice/commit/8067d6b
• https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0
• https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f

Published

Jun 5, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45320DataEase is an open source data visualization and analysis t…8.7
• CVE-2026-45321On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84…9.6
• CVE-2026-45322Microsoft UFO open-source framework for intelligent automati…7.8
• CVE-2026-45323MeshCore Card provides MeshCore Lovelace card for Home Assis…9.6
• CVE-2026-45324Rizin is a UNIX-like reverse engineering framework and comma…3.3
• CVE-2026-45325Gestor de Oferta is a web application for managing mobility …8.2
• CVE-2026-45328ESF-IDF is the Espressif Internet of Things (IOT) Developmen…8.8
• CVE-2026-45329ESF-IDF is the Espressif Internet of Things (IOT) Developmen…6.5
• CVE-2026-4533A vulnerability was detected in code-projects Simple Food Or…8.8
• CVE-2026-45330Decidim is a participatory democracy framework. Prior to 0.3…4.9
• CVE-2026-45331Open WebUI is a self-hosted artificial intelligence platform…8.5
• CVE-2026-45332Automad is a flat-file content management system and templat…7.5