Approved changes feed: RSS · Atom
cpe:2.3:a:datanoisetv:tinyice:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Datanoisetv (869c1b47-b0fb-5c28-be06-6758d514e554) |
|---|---|
| Product | Tinyice (2a9608c5-5d54-5c66-a59f-9b3a1de31ccd) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-45327 |
vulnerable | 2026-06-08 08:05:11.699606 |
TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection
HIGH (8.2)
TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token.
Published: 2026-06-05T16:57:52.612Z
Updated: 2026-06-05T19:07:26.982Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.