An authentication flaw in OSSRS SRS (Simple Realtime Server) when the vhost security setting is enabled allows a remote attacker to bypass publish authorization checks and run arbitrary code on the host. This flaw resides in the SrsSecurity::check function underlying the RTMP listener, which fails to enforce the intended permission model during the publish phase. Because the vulnerability is exploitable without additional preconditions other than reaching the RTMP endpoint, an attacker can compromise confidentiality, integrity, and availability of the affected server by executing arbitrary system commands.

Any deployment of OSSRS SRS earlier than version 5.0.213 that has the vhost security feature enabled is vulnerable. The issue specifically targets the RTMP publish authorization component found in trunk/src/app/srs_app_security.cpp. No other vendor or product variants are currently affected.

The flaw permits remote code execution over the public RTMP interface, which is typically exposed to the internet. With a CVSS score of 9.8, the vulnerability is considered critical; the EPSS score of < 1% reflects a low but nonzero exploit probability. While no public exploit has been tracked in the KEV catalog, the inherent nature of the vulnerability and the lack of defensive controls make it a high‑risk flaw for exposed services. Standard attack vectors would involve sending a crafted RTMP publish request from a remote host, triggering the unchecked authorization routine and consequently granting the attacker control to execute arbitrary system commands.