PT-2026-106307

CVE-2026-105486

Published

2026-10-06

Updated

2026-10-06

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OSSRS srs versions prior to 8.0-d0

Description An issue exists in the System API component within the systemAPI.Run() function of the internal/proxy/api.go file. A remote attacker can perform a manipulation that results in missing authentication, allowing unauthorized access to the system.

Recommendations Upgrade to version 8.0-d0. As a temporary mitigation, restrict access to the systemAPI.Run() function.

Exploitability

Exploit

Fix

Impacts

Researchers

Geochen

Vendors

Affected products

Weakness enumeration

CWE-306: Missing Authentication for Critical Function

CWE-287: Improper Authentication