VulnSocial

CVE-2026-45327Disclosure

LOWCVSS 8.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-06-05); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-06-05: 1Mentions · 2026-06-08: 1Patch / Workaround · 2026-06-08: 1Technical Details · 2026-06-05: 1Technical Details · 2026-06-08: 106-0506-08
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-06-051
Disclosure1
2026-06-081
Patch1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-45327 - CSRF in Tinyice streaming server. Unauthenticated WebRTC stream injection via missing auth. CVSS 8.2. No patch available. Mitigate by restricting network access immediately. #CVE #infosec #Tinyice #CVEAlert More CVE Alerts and Patches https://www.valtersit.com/cve/CVE-2026-45327/

    Post summary

    The post announces CVE‑2026‑45327, a CSRF flaw in Tinyice’s streaming server, notes the absence of an official patch and recommends immediate network restrictions as a workaround, with a CVSS score of 8.2.

    0001073
    921 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-45327 Unauthenticated Stream Injection in TinyIce WebRTC Ingest Endpoint Versions 0.8.95-2.4.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45327

    Post summary

    CVE-2026-45327 describes an unauthenticated stream injection flaw in TinyIce WebRTC ingest endpoints (versions 0.8.95-2.4.1) with no evidence of PoC, exploit code, or active exploitation reported.

    0000049
    4.0K followersView on X

Explore more

Back to dashboard