Play bypasses authorization when server configures only on_frame_cb

[cursor]

Summary

Severity: Medium

When a Server registers only on_frame_cb but not on_play_cb, any network peer that completes RTMP handshake and connect can issue createStream + play and receive relayed media (including init-cache replay) without authorization.

Attacker

Any unauthenticated network client.

Controlled input

RTMP AMF play command after connect.

Attack path

read_messages → handle_command_message → play handler in src/session/conn.rs. The guard that rejects play when only on_publish_cb/on_media_cb are configured did not include on_frame_cb, so play proceeded and relay_enabled was set.

Impact

Unauthorized playback and bandwidth consumption from stream cache / live relay.

Location

src/session/conn.rs

Remediation

Treat on_frame_cb like on_media_cb: reject play when on_play_cb is unset but on_frame_cb is configured.