EUVD-2026-60448
GHSA-fchr-h2rx-xx6p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated bypass of publish authorization (AV:N/AC:L/PR:N) yields high integrity impact via unauthorized publishing/stream hijack; confidentiality/availability are lower and the RCE-driven C:H/A:H are unverified.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level security configuration (security.enabled), SrsSecurity::check(), trunk/src/app/srs_app_security.cpp, and SRS RTMP listener components
AnalysisAI
Improper access control in OSSRS SRS (Simple Realtime Server) before v5.0.213 allows remote attackers to bypass RTMP publish authorization enforced by the vhost security layer (security.enabled / SrsSecurity::check() in trunk/src/app/srs_app_security.cpp), enabling unauthorized stream publishing and, per the report, arbitrary code execution against the RTMP listener. The issue is tagged as both RCE and Authentication Bypass and affects deployments that rely on SRS's built-in allow/deny security rules to gate who may publish. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the SRS RTMP listener (default TCP 1935) and a vhost that depends on SRS's built-in security enforcement (security.enabled with allow/deny publish rules) to restrict who may publish - the flaw is that SrsSecurity::check() fails to correctly enforce that policy. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to OSSRS SRS v5.0.213 or later (Vendor-released patch: v5.0.213, shipped in release v5.0-r3, https://github.com/ossrs/srs/releases/tag/v5.0-r3). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a network inventory to identify all OSSRS SRS instances running versions below 5.0.213 and their RTMP exposure (exposed to internet vs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today