CVE-2026-68004
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
An issue in OSSRS SRS (Simple Realtime Server) before v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level security configuration (security.enabled), SrsSecurity::check(), trunk/src/app/srs_app_security.cpp, and SRS RTMP listener components.
Risk Assessment
An attacker can exploit the vulnerability to execute arbitrary code on the server, potentially leading to full system compromise and data integrity violation.
Recommendation
Update SRS to version 5.0.213 or later and review vhost-level security configuration.
Original NVD description (English source)
An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level security configuration (security.enabled), SrsSecurity::check(), trunk/src/app/srs_app_security.cpp, and SRS RTMP listener components