Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-68004 — Standalone PoC for unauthenticated RTMP publish in SRS media servers; verifies the vulnerability, supports HTTP API side-channel check, and enables authorized penetration testing. | Kitploit
Tools/GitHubGitHub/xuwu-xuwu/cve-2026-68004
Vulnerability AnalysisExploitationNetwork SecurityPenetration TestingMisconfiguration
GitHubxuwu-xuwu/cve-2026-68004

CVE-2026-68004

Standalone PoC for unauthenticated RTMP publish in SRS media servers; verifies the vulnerability, supports HTTP API side-channel check, and enables authorized penetration testing.

View Repository
523 days agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-68004：SRS Unauthenticated RTMP Publish

Overview

This repository contains the technical report and proof-of-concept for CVE-2026-68004, an unauthenticated RTMP publish issue in OSSRS / SRS deployments where vhost.security is disabled and no other publish authentication is configured.

Files

FilePurpose
CVE_Report_SRS_Unauth_Publish.mdVulnerability report
poc_srs_unauth_publish.pyStandalone Python 3 PoC using only the standard library

Run PoC

Only run this against systems you are authorized to test.

root@kitploit:~
python poc_srs_unauth_publish.py --host 127.0.0.1 --stream cve_2026_68004_poc

Vulnerable:

root@kitploit:~
[+] VULNERABLE: received NetStream.Publish.Start

With HTTP API side-channel check:

root@kitploit:~
python poc_srs_unauth_publish.py --host TARGET --check-api --json

Exit code: 0 = publish confirmed, 2 = not confirmed.

Reporter

HongYuan Liu [email protected]

Download Tool