CVE-2026-45327: TinyIce Auth Bypass Vulnerability

CVE-2026-45327 Overview

CVE-2026-45327 is a missing authentication vulnerability [CWE-306] in TinyIce, an open-source streaming server for audio and video. The flaw affects the WebRTC ingest endpoint in versions 0.8.95 through 2.4.1. Unauthenticated attackers can inject arbitrary audio streams into any mount point, hijacking broadcasts delivered to listeners. The adjacent POST /admin/golive/chunk endpoint also lacked per-mount access checks and CSRF token verification. Version 2.5.0 resolves both issues by enforcing bcrypt-based password verification and CSRF validation.

Critical Impact
Any internet-connected attacker who can reach the TinyIce server can hijack a station's live broadcast and feed arbitrary audio to its listeners without credentials.

Affected Products

TinyIce streaming server versions 0.8.95 through 2.4.1
WebRTC ingest endpoint (/webrtc/source-offer)
Administrative endpoint POST /admin/golive/chunk

Discovery Timeline

2026-06-05 - CVE-2026-45327 published to NVD
2026-06-05 - Last updated in NVD database

Technical Details for CVE-2026-45327

Vulnerability Analysis

TinyIce exposes a WebRTC ingest endpoint at /webrtc/source-offer that accepts a Session Description Protocol (SDP) offer and begins ingesting audio via the pion WebRTC stack. In vulnerable releases, this handler performs no authentication. The Icecast SOURCE, Real-Time Messaging Protocol (RTMP), and Secure Reliable Transport (SRT) ingest paths each require the per-mount source password or the configured default_source_password. The WebRTC path bypassed all of these controls.

An attacker who can reach the HTTP listener can POST an SDP offer for any mount name and begin broadcasting. TinyIce will relay the injected audio to every connected listener of that mount. The flaw is tracked as CWE-306 (Missing Authentication for Critical Function).

The related POST /admin/golive/chunk endpoint required a logged-in session but did not verify whether that session user had access to the targeted mount, nor did it validate the Cross-Site Request Forgery (CSRF) token. A low-privilege authenticated user or a victim's browser could be coerced into uploading chunks to mounts outside their authorization scope.

Root Cause

The WebRTC handler was added without porting the existing checkAuthLimit, getSourcePassword, and CheckPasswordHash flow used by other ingest handlers. The result is an authentication gap rather than a logic error in credential checking.

Attack Vector

Exploitation requires only network reachability to the TinyIce HTTP port. The attacker sends a crafted POST to /webrtc/source-offer containing an SDP offer naming a target mount. No credentials, session, or user interaction is required.

 		return
 	}
 
+	// Auth gate. The icecast SOURCE / RTMP / SRT ingest paths all
+	// require the per-mount source password (or DefaultSourcePassword)
+	// before accepting a publish; this endpoint MUST do the same.
+	// Without it, anyone on the internet who can POST here can hijack
+	// any mount's broadcast — pion happily ingests whatever audio they
+	// send, and tinyice broadcasts it to the radio's listeners.
+	//
+	// Accept the credentials via either Basic auth (matches handleSource)
+	// or a `password` query parameter for browser callers that can't
+	// always send Basic on a fetch().
+	host, _, _ := net.SplitHostPort(r.RemoteAddr)
+	if err := s.checkAuthLimit(host); err != nil {
+		http.Error(w, "Unauthorized", http.StatusUnauthorized)
+		return
+	}
+	requiredPass, found := s.getSourcePassword(mount)
+	if !found {
+		requiredPass = s.Config.DefaultSourcePassword
+	}
+	supplied := ""
+	if _, p, ok := r.BasicAuth(); ok {
+		supplied = p
+	} else if q := r.URL.Query().Get("password"); q != "" {
+		supplied = q
+	}
+	if requiredPass == "" || !config.CheckPasswordHash(supplied, requiredPass) {
+		s.recordAuthFailure(host)

Source: GitHub Commit 8067d6b. This patch adds the missing authentication gate to /webrtc/source-offer, enforcing bcrypt password verification and integrating the existing brute-force IP rate-limiter.

Detection Methods for CVE-2026-45327

Indicators of Compromise

Unexpected POST /webrtc/source-offer requests in TinyIce HTTP access logs from unknown source addresses.
Listeners reporting unauthorized audio content replacing the legitimate broadcast on any mount.
Concurrent ingest sessions for the same mount where only one should be active.
POST requests to /admin/golive/chunk lacking a valid CSRF token or originating from cross-origin referers.

Detection Strategies

Review TinyIce HTTP access logs for POST requests to /webrtc/source-offer and correlate against known broadcaster IP addresses.
Alert on any successful WebRTC ingest from source addresses that have not previously authenticated through Icecast SOURCE, RTMP, or SRT paths.
Monitor for sudden changes in audio fingerprint or RMS levels on outbound mounts that do not match the broadcaster's scheduled programming.

Monitoring Recommendations

Place the TinyIce HTTP listener behind a reverse proxy that logs full request metadata for forensic review.
Forward TinyIce logs to a centralized log platform and build alerts on ingest-endpoint access patterns.
Track failed authentication counts per source IP to detect brute-force activity against the new auth gate.

How to Mitigate CVE-2026-45327

Immediate Actions Required

Upgrade TinyIce to version 2.5.0 or later, which enforces authentication on /webrtc/source-offer and tightens POST /admin/golive/chunk.
Configure strong per-mount source passwords and a non-empty default_source_password fallback before exposing the service.
Add mounts that should not accept ingest to the disabled_mounts list to ensure they are rejected outright.
Restrict network access to the TinyIce HTTP port to known broadcaster IP ranges using a firewall or reverse proxy ACL.

Patch Information

The fix is included in TinyIce Release v2.5.0. The patch commit 8067d6b adds bcrypt password verification, hooks the WebRTC handler into the existing IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and enforces CSRF and per-mount access checks on /admin/golive/chunk. Full advisory details are available in GHSA-p7c4-8x34-8j8f.

Workarounds

Block external access to /webrtc/source-offer at a reverse proxy until the upgrade can be applied.
Require client certificate authentication or HTTP Basic auth at the proxy layer for any path under /webrtc/ and /admin/.
Disable WebRTC ingest entirely if it is not in active use and rely on Icecast SOURCE, RTMP, or SRT paths that already enforce passwords.

bash

# Example nginx reverse proxy restriction until upgrade to v2.5.0
location /webrtc/source-offer {
    allow 203.0.113.10;   # trusted broadcaster
    allow 198.51.100.0/24; # studio network
    deny all;
    proxy_pass http://127.0.0.1:8000;
}

location /admin/ {
    auth_basic "TinyIce Admin";
    auth_basic_user_file /etc/nginx/tinyice.htpasswd;
    proxy_pass http://127.0.0.1:8000;
}