CVE-2026-112104: eremef bandcamp-player Remote Control Server database.ts missing authentication
A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. Executing a manipulation of the argument remoteEnabled can lead to missing authentication. The attack may be launched remotely. Upgrading to version 1.8.34-beta is sufficient to resolve this issue. This patch is called ccba99b66bc61acf46e4a332034799d7452ddea6. Upgrading the affected component is advised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
eremef bandcamp-playerto a version that resolves this vulnerability.Fixed in 1.8.34-betaPatch ccba99b66bc61acf46e4a332034799d7452ddea6
Event History
Frequently Asked Questions
Which deployments are affected?
eremef bandcamp-player versions up to and including 1.8.33-beta are affected when using the Remote Control Server component and its database.ts functionality.
What does an attacker need to exploit this issue?
The issue can be exploited remotely and does not require privileges or user interaction. Exploitation involves manipulating the remoteEnabled argument to bypass authentication.
How should this be remediated?
Upgrade eremef bandcamp-player to version 1.8.34-beta or later. The remediation is associated with patch ccba99b66bc61acf46e4a332034799d7452ddea6.