Executive brief
TinyIce is a streaming server used for broadcasting audio and video content. A security flaw in its WebRTC ingest component allows any internet user to hijack a live broadcast and replace it with their own audio or video without needing a password. This could lead to unauthorized content being broadcast to all listeners, potentially damaging the reputation of the broadcaster or disrupting operations.
Technical details
The vulnerability exists in the `POST /webrtc/source-offer` endpoint due to a failure to implement authentication checks (CWE-306). While other ingest methods like RTMP and SRT require a source password, the WebRTC path accepted any Session Description Protocol (SDP) offer and immediately began broadcasting the peer's media to the specified mount. An attacker can identify public mount names and negotiate a WebRTC connection to hijack the broadcast. Additionally, the `POST /admin/golive/chunk` endpoint was found to lack CSRF protection and proper per-mount access verification. These issues are resolved in version 2.5.0, which introduces bcrypt-validated password requirements and rate-limiting for WebRTC ingest.
Affected products
- DatanoiseTV TinyIce 0.8.95 - 2.4.1
Timeline
- 2026-02-21: other: Vulnerability introduced in commit e2b60d6
- 2026-05-09: patched: Fixed in version 2.5.0
- 2026-05-09: advisory: GitHub Security Advisory published
- 2026-06-05: disclosed: CVE published to NVD