TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection — CVE-2026-45327

Summary

## Title Missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection in TinyIce ## Ecosystem / Package - **Ecosystem:** `Go` (or "Other" — TinyIce is shipped as a Go binary, not a Go module published to a registry) - **Package name:** `github.com/DatanoiseTV/tinyice` ## Affected versions ``` >= 0.8.95, <= 2.4.1 ``` (Introduced 2026-02-21 in commit `e2b60d6` — "debug: add Go Live…

Product

go: github.com/DatanoiseTV/tinyice

What to do

General, cautious steps (verify details in the official source):

• Prioritize patching or mitigation immediately (treat as actively risky).
• Identify affected product versions in your inventory and verify whether you are impacted.
• Apply vendor patches/updates or recommended mitigations as soon as available.
• Read the official advisory for exact affected versions and remediation steps.

Official advisory

• Read the official source
• CVE Record
• NVD

Related advisories