OSSRS SRS CVE-2026-105486

The SRS proxy component's System API (systemAPI.Run in internal/proxy/api.go) ships with NO authentication, and per the vendor patch the new bearer-token auth is disabled by default (PROXY_HTTP_API_AUTH_ENABLED=off) - so any default deployment of the SRS proxy that exposes this API is exploitable by a remote unauthenticated attacker. The principal LIMITING factor is deployment scope: exploitation requires that the newer SRS proxy/registration mode actually be in use and that its System API port be network-reachable to the attacker (e.g., not firewalled to an internal management network); SRS instances running without the proxy component, or with the API bound to loopback/isolated networks, are not exposed. Affected versions are SRS up to 7.0-a1.

This is a genuine but moderate-priority issue, not an inflated high-CVSS finding. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, which is credible given CWE-306 (missing authentication) on the proxy System API (systemAPI.Run in internal/proxy/api.go). However, the impact metrics are all Low (VC:L/VI:L/VA:L) with no scope change, which is why the base score lands at 6.9 (medium) rather than critical - the exposed API confers limited confidentiality/integrity/availability impact rather than full host compromise. The exploit-maturity flag E:P and the POC signal agree: public proof-of-concept exploit code exists (GitHub issue #4690), but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active, widespread exploitation - treat this as exploitable-in-principle rather than confirmed in-the-wild. One nuance worth flagging: the vendor patch (PR #4726) adds authentication only as an OPT-IN bearer mechanism that is DISABLED BY DEFAULT (PROXY_HTTP_API_AUTH_ENABLED=off), so upgrading to 8.0-d0 alone does not close the exposure unless operators also enable and configure the new auth - this materially affects real-world risk reduction. The reporting source is VulDB only, with no independent vendor security advisory, so severity details should be weighted accordingly.

An attacker who can reach the SRS proxy's System API endpoint over the network sends crafted HTTP requests directly to systemAPI.Run without supplying any credentials, since the endpoint performs no authentication. Because public proof-of-concept exploit code exists (GitHub issue #4690) and the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires no special tooling, user interaction, or privileges - only network reachability to the proxy API.