{"id":"GHSA-p7c4-8x34-8j8f","revision":null,"records":[{"revision":"9aa9d42a5bc74812a3394a5ad044bd13","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-45327","aliases":[],"title":"TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection","description":"TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token.","state":0,"publishedAt":"2026-06-05T16:57:52.612+00:00","modifiedAt":"2026-06-05T19:07:26.982+00:00","affected":[{"ecosystem":"Vendor product","name":"tinyice","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"DatanoiseTV\",\n                    \"product\": \"tinyice\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 0.8.95, < 2.5.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","score":8.2,"severity":"HIGH"}],"references":["https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f","https://github.com/DatanoiseTV/tinyice/commit/8067d6b","https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-45327","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-45327","identifiers":["CVE-2026-45327"]},"retained":false,"historicalAffected":[]},{"revision":"dd87e7ffc5ad4ac9a8a997751c212781","observedAt":"2026-11-07T10:34:05.801+00:00","statement":{"source":"euvd","id":"EUVD-2026-34863","aliases":["CVE-2026-45327","GHSA-p7c4-8x34-8j8f"],"title":"TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth…","description":"TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","score":8.2,"severity":null}],"references":["https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f","https://github.com/DatanoiseTV/tinyice/commit/8067d6b","https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-34863","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 5, 2026, 4:57:52 PM","dateUpdated":"Jun 5, 2026, 7:07:26 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-34863","identifiers":["EUVD-2026-34863","CVE-2026-45327","GHSA-p7c4-8x34-8j8f"]},"retained":false,"historicalAffected":[]},{"revision":"bbf7f2de30f0422c9c7038ec7d7b0de9","observedAt":"2026-10-27T11:12:23.45+00:00","statement":{"source":"nvd","id":"CVE-2026-45327","aliases":[],"title":"TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth…","description":"TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token.","state":0,"publishedAt":"2026-06-05T18:17:27.22+00:00","modifiedAt":"2026-10-25T23:10:00.167+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","score":8.2,"severity":"HIGH"}],"references":["https://github.com/DatanoiseTV/tinyice/commit/8067d6b","https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0","https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45327","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-306"],"productCriteria":[],"sourceDates":{"published":"2026-06-05T18:17:27.220","lastModified":"2026-10-25T23:10:00.167"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-45327","identifiers":["CVE-2026-45327"]},"retained":false,"historicalAffected":[]},{"revision":"0d0337eee24d4f85a6e7ec2a4e62721b","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-p7c4-8x34-8j8f","aliases":["CVE-2026-45327","GO-2026-5534"],"title":"TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection","description":"## Title\n\nMissing authentication on WebRTC ingest endpoint allows unauthenticated stream injection in TinyIce\n\n## Ecosystem / Package\n\n- **Ecosystem:** `Go` (or \"Other\" — TinyIce is shipped as a Go binary, not a Go module published to a registry)\n- **Package name:** `github.com/DatanoiseTV/tinyice`\n\n## Affected versions\n\n```\n>= 0.8.95, <= 2.4.1\n```\n\n(Introduced 2026-02-21 in commit `e2b60d6` — \"debug: add Go Live connection tracing and backend data flow logging\" — when `handleWebRTCSourceOffer` was registered at `/webrtc/source-offer` without an authentication check. Every tagged release from `v0.8.95` through `v2.4.1` ships the vulnerable handler.)\n\n## Patched versions\n\n```\n>= 2.5.0\n```\n\n## Severity\n\n- **CVSS 3.1 base score:** 7.4 (High)\n- **CVSS vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L`\n- **CWE:** [CWE-306: Missing Authentication for Critical Function](https://cwe.mitre.org/data/definitions/306.html)\n\n## Description\n\nTinyIce's WebRTC source-ingest HTTP endpoint, `POST /webrtc/source-offer?mount=<mount>`, accepted any inbound WebRTC SDP offer with no authentication check. The handler routed the offer to `WebRTCManager.HandleSourceOffer`, which then accepted whatever audio/video tracks the peer published and broadcast them on the named mount as if they were the legitimate source.\n\nThe other ingest paths (`POST /<mount>` over HTTP/1 with the icecast `SOURCE` / `PUT` verb, RTMP, SRT) all require the per-mount source password, falling back to `default_source_password` from the config. The WebRTC ingest path didn't.\n\n## Impact\n\nA network attacker who can reach the TinyIce HTTP port can:\n\n1. Identify a target mount (mount names are public — they appear in the directory listing, the player URL, and the YP listing).\n2. Negotiate a WebRTC peer connection with the server.\n3. Publish arbitrary Opus / H.264 to that mount.\n4. Have it broadcast to every listener on the mount.\n\nThis is a high-integrity-impact issue: an attacker can replace a radio's broadcast with their own audio (silence, noise, malicious content, branded competitor content, etc.). Listeners hear what the attacker sends, not what the legitimate publisher intended.\n\nThe legitimate publisher can re-establish their session — TinyIce's source-takeover handshake gives the new offer priority once it arrives, with a 3-second drain of the previous pump goroutine — but the attacker can in principle re-connect immediately after, producing a sustained broadcast hijack until the operator manually intervenes (block at firewall, rotate source passwords once the patch is applied, restart the service).\n\nThere is no direct confidentiality impact through this endpoint: the attacker doesn't gain access to listener data or other mounts' content.\n\n## Workarounds\n\nIf users cannot upgrade immediately:\n\n- **Recommended:** block `POST /webrtc/source-offer` at the reverse proxy in front of TinyIce. The endpoint has no production use case for clients outside the operator's own administration — disabling it loses no functionality unless the consuming application specifically use the browser-based \"go-live\" feature.\n- Restrict TinyIce's HTTP port to a trusted network (VPN, internal LAN). Listener access can still be served via a separately-firewalled CDN if the application needs public listening.\n\n## Detection\n\nTo check whether an application's deployment is exposed, run from outside the network:\n\n```\ncurl -i -X POST 'https://your-tinyice-host/webrtc/source-offer?mount=/anymount' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"type\":\"offer\",\"sdp\":\"v=0\\r\\n\"}'\n```\n\n- If the response is `400 Bad Request` with a JSON body containing an SDP-parsing error from `pion/webrtc`, **a consuming application is vulnerable** — the server tried to negotiate the (malformed) offer without asking for credentials.\n- If the response is `401 Unauthorized` (Basic auth challenge), the consuming application has been patched.\n\nAuthenticated log lines on a patched server will look like:\n\n```\nWARN  Authentication failed for user 'webrtc-source' from 1.2.3.4: invalid source password\n```\n\n## Fix\n\nUpstream commit: [`8067d6b`](https://github.com/DatanoiseTV/tinyice/commit/8067d6b) \"fix(api): require source password on /webrtc/source-offer + CSRF/access on /go-live-chunk\".\n\nThe handler now:\n\n1. Requires either HTTP Basic auth or a `?password=` query parameter.\n2. Compares the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt.\n3. Hooks into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout).\n4. Rejects requests for mounts in `disabled_mounts`.\n\nThe same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token.\n\n## Timeline\n\n- 2026-02-21 — Vulnerable handler introduced (`e2b60d6`).\n- 2026-05-09 — Vulnerability identified during a maintainer-led audit.\n- 2026-05-09 — Patched in commit `8067d6b`, released as `v2.5.0`.\n- 2026-05-09 — GitHub Security Advisory published, CVE assigned.","state":0,"publishedAt":"2026-05-18T17:20:17+00:00","modifiedAt":"2026-06-25T23:11:24.1931789+00:00","affected":[{"ecosystem":"Go","name":"github.com/DatanoiseTV/tinyice","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.8.95"},{"kind":"fixed","version":"2.5.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f","https://nvd.nist.gov/vuln/detail/CVE-2026-45327","https://github.com/DatanoiseTV/tinyice/commit/8067d6b","https://github.com/DatanoiseTV/tinyice","https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0"],"sourceUrl":"https://github.com/advisories/GHSA-p7c4-8x34-8j8f","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-p7c4-8x34-8j8f","identifiers":["GHSA-p7c4-8x34-8j8f","CVE-2026-45327","GO-2026-5534"]},"retained":false,"historicalAffected":[]},{"revision":"364ff259091f4c988164e11b2f6456a1","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5534","aliases":["CVE-2026-45327","GHSA-p7c4-8x34-8j8f"],"title":"TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection in github.com/DatanoiseTV/tinyice","description":"TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection in github.com/DatanoiseTV/tinyice.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/DatanoiseTV/tinyice before v2.5.0.","state":0,"publishedAt":"2026-06-25T22:34:34+00:00","modifiedAt":"2026-06-25T23:01:20.9611797+00:00","affected":[{"ecosystem":"Go","name":"github.com/DatanoiseTV/tinyice","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.8.95"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/DatanoiseTV/tinyice/security/advisories/GHSA-p7c4-8x34-8j8f","https://nvd.nist.gov/vuln/detail/CVE-2026-45327","https://github.com/DatanoiseTV/tinyice/commit/8067d6b","https://github.com/DatanoiseTV/tinyice/releases/tag/v2.5.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5534","license":"OSV · upstream source license applies","key":"osv:GO-2026-5534","identifiers":["GO-2026-5534","CVE-2026-45327","GHSA-p7c4-8x34-8j8f"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T20:52:46.7845564+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T20:52:46.7845564+00:00","lastSuccessAt":"2026-11-07T20:52:46.9707302+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.9707321+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-1766179264875bb4621a23ce4c6bcebec63fb794a16e35c2f5592f4ee300ee2e","complete":true,"records":420944,"lastAttemptAt":"2026-11-07T20:52:46.1142943+00:00","lastSuccessAt":"2026-11-07T20:52:46.0341312+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.1142943+00:00","snapshotPublishedAt":"2026-11-07T20:26:36+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-cbfb00168958467aaa6015d5230faa08","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T21:04:54.6100336+00:00","lastSuccessAt":"2026-11-07T21:04:54.606+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:04:54.606+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T20:52:46.7845564+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T20:52:46.7845564+00:00","lastSuccessAt":"2026-11-07T20:52:47.1482288+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:47.1482303+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b9464f9c589b4886928e7045b5ad1e11","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T20:52:54.6850231+00:00","lastSuccessAt":"2026-11-07T20:52:54.68+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:54.68+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T20:52:46.6024506+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.6024506+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T20:52:46.3552169+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.3552169+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T20:52:46.7261257+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.7261257+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T20:52:46.4923243+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.4923243+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}