Publish bypasses authorization when server configures only on_frame_cb

[cursor]

Summary

Severity: Medium

When a Server registers only on_frame_cb (a common pattern for frame observation/logging) but not on_publish_cb, any network peer that completes RTMP handshake and connect can issue createStream + publish and have media relayed without authorization.

Attacker

Any unauthenticated network client.

Controlled input

RTMP AMF publish command after connect.

Attack path

read_messages → handle_command_message → publish handler in src/session/conn.rs. The guard that rejects publish when only on_play_cb/on_media_cb are configured did not include on_frame_cb, so publish proceeded and relay_enabled was set.

Impact

Unauthorized publishing and relay fan-out to legitimate players on the built-in server relay path.

Location

src/session/conn.rs

Remediation

Treat on_frame_cb like on_media_cb: reject publish when on_publish_cb is unset but on_frame_cb is configured.