All vulnerabilities
CVE-2026-112104

eremef bandcamp-player Remote Control Server database.ts missing authentication

eremef bandcamp-player
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.80%Chance of exploitation activity in the next 30 days, higher than 56% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published19 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. Executing a manipulation of the argument remoteEnabled can lead to missing authentication. The attack may be launched remotely. Upgrading to version 1.8.34-beta is sufficient to resolve this issue. This patch is called ccba99b66bc61acf46e4a332034799d7452ddea6. Upgrading the affected component is advised.

Text from CVE List

Affected versions 2

  • bandcamp-playeraffected: 1.8.33-betaCVE List
  • bandcamp-playerunaffected: 1.8.34-betaCVE List

References 9