8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45327

CVE-2026-45327: TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection

TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a ?password= query parameter, comparing the supplied password against the per-mount source password (or the default_source_password fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in disabled_mounts. The same release also tightens an adjacent endpoint, POST /admin/golive/chunk, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45327

CVE-2026-45327:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/DatanoiseTV/tinyice	go	>= 0.8.95, <= 2.4.1	2.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security advisory and the associated patch commit 8067d6b reveals two vulnerable functions in server/handlers_api.go. The primary vulnerability, and the focus of the CVE, is the complete lack of authentication in the Server.handleWebRTCSourceOffer function. This allowed unauthenticated attackers to hijack broadcast streams. The patch rectifies this by adding robust authentication and rate-limiting mechanisms, mirroring the security controls on other ingest paths.

A secondary, but also significant, vulnerability was addressed in the Server.handleGoLiveChunk function. This function was vulnerable to Cross-Site Request Forgery (CSRF) and lacked proper authorization checks. An attacker could exploit this to force an authenticated administrator's browser to broadcast malicious content to any mount. The patch mitigates this by adding explicit CSRF and access control checks. Both functions are critical as they handle the ingestion of media streams, and their exploitation has a high impact on the integrity of the service.

Vulnerable functions

Server.handleWebRTCSourceOffer

server/handlers_api.go

This function, which handles the `POST /webrtc/source-offer` endpoint, was missing authentication entirely. This allowed any unauthenticated attacker to send a WebRTC offer and inject an arbitrary media stream into any mount point, effectively hijacking the broadcast. The vulnerability is a classic 'Missing Authentication for Critical Function' (CWE-306).

Server.handleGoLiveChunk

server/handlers_api.go

This function, handling the `POST /admin/golive/chunk` endpoint, had two security flaws. First, it lacked CSRF protection, making it possible for an attacker to trick an administrator's browser into making a malicious request. Second, it suffered from a missing authorization check (CWE-862); while it verified that a user was logged in, it didn't check if that user had permission to broadcast to the specified mount. This allowed any authenticated user to broadcast to any mount, regardless of their permissions.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.