The vulnerability lies in the internal/proxy/api.go file of OSSRS srs and allows an attacker to invoke systemAPI.Run without authentication. This flaw is an Authentication Failure (CWE‑287) and a Missing Authentication for Critical Function (CWE‑306). Because the function executes privileged operations, successful exploitation would let the attacker perform unauthorized actions on the system, compromising confidentiality, integrity, or availability of the streaming service.

The issue affects OSSRS srs versions up to 7.0‑a1. The vendor recommends upgrading to release 8.0‑d0, which contains the referenced patch. Systems running any earlier releases are vulnerable.

With a CVSS base score of 6.9 the vulnerability is considered moderate. The EPSS score is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog, but the public exploit code indicates that it can be used remotely. Attackers can reach the vulnerable function over the network and, without authentication, trigger privileged operations.