CVE-2026-105486mediumCWE-287CWE-306

CVE-2026-105486: fallo de gravedad media en OSSRS srs

OSSRS srs System API api.go systemAPI.Run missing authentication

Publicada el

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 6.9epss 0.5%
probabilidad de explotación
0.5%top 59% de las CVE
explotación observada
noninguna fuente lo reporta
1 exploit(s) público(s)
A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 8.0-d0 mitigates this issue. The patch is named bb5fde228f4ca5bd26d96368b61f6e0c21df51df. The affected component should be upgraded.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
OSSRS · srs
PoCs públicas encontradas — 1
cve_referencegithub.com/ossrs/srs/issues/4690no verificado
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://github.com/ossrs/srs/https://github.com/ossrs/srs/commit/bb5fde228f4ca5bd26d96368b61f6e0c21df51dfhttps://github.com/ossrs/srs/issues/4690https://github.com/ossrs/srs/pull/4726https://github.com/ossrs/srs/releases/tag/v8.0-d0https://vuldb.com/cve/CVE-2026-105486https://vuldb.com/submit/986193https://vuldb.com/vuln/413620https://vuldb.com/vuln/413620/cti