CVE-2026-105486: OSSRS srs System API api.go systemAPI.Run missing authentication
A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 8.0-d0 mitigates this issue. The patch is named bb5fde228f4ca5bd26d96368b61f6e0c21df51df. The affected component should be upgraded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OSSRS srsto a version that resolves this vulnerability.Fixed in 8.0-d0Patch bb5fde228f4ca5bd26d96368b61f6e0c21df51df
Event History
Frequently Asked Questions
Which deployments are affected?
OSSRS srs deployments up to version 7.0-a1 are affected where the System API includes the vulnerable systemAPI.Run function in internal/proxy/api.go. Version 8.0-d0 is identified as the mitigating upgrade.
Does an attacker need credentials or local access?
No credentials, local access, or user interaction are indicated. The issue can be exploited remotely due to missing authentication in the affected System API function.
Is exploitation publicly available?
Yes. A public exploit is reported, so affected remotely reachable instances should be prioritized for upgrade.
What should be done to remediate the issue?
Upgrade the affected component to OSSRS srs version 8.0-d0. The identified patch is bb5fde228f4ca5bd26d96368b61f6e0c21df51df.