An authentication flaw in OSSRS SRS (Simple Realtime Server) when the vhost security setting is enabled allows a remote attacker to bypass publish authorization checks and run arbitrary code on the host. This flaw resides in the SrsSecurity::check function underlying the RTMP listener, which fails to enforce the intended permission model during the publish phase. Because the vulnerability is exploitable without additional preconditions other than reaching the RTMP endpoint, an attacker can compromise confidentiality, integrity, and availability of the affected server by executing arbitrary system commands.

Any deployment of OSSRS SRS earlier than version 5.0.213 that has the vhost security feature enabled is vulnerable. The issue specifically targets the RTMP publish authorization component found in trunk/src/app/srs_app_security.cpp. No other vendor or product variants are currently affected.

The flaw permits remote code execution over the public RTMP interface, which is typically exposed to the internet. While no public exploit has been tracked in the KEV catalog and EPSS data is unavailable, the inherent nature of the vulnerability and the lack of defensive controls make it a high‑risk flaw for exposed services. Standard attack vectors would involve sending a crafted RTMP publish request from a remote host, triggering the unchecked authorization routine and consequently leaking control to the attacker. Given the severity of the impact, administrators should treat this as a critical issue even in the absence of publicly available exploitation tools.