CVE-2026-112104

7.3High

Published 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.3High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-287, CWE-306

Impact

Remote, unauthenticated attackers can bypass authentication on the Remote Control Server component. They only need network access to the server to send manipulated requests.

Root cause

Improper handling of the remoteEnabled argument in database.ts allows requests to bypass required authentication checks.

Affected systems

eremef bandcamp-player through 1.8.33-beta

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Fix & remediation

Upgrade bandcamp-player to version 1.8.34-beta or apply commit ccba99b66bc61acf46e4a332034799d7452ddea6. If you cannot update immediately, disable network exposure to the Remote Control Server.

shell

$ npm install bandcamp-player@1.8.34-beta

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. Executing a manipulation of the argument remoteEnabled can lead to missing authentication. The attack may be launched remotely. Upgrading to version 1.8.34-beta is sufficient to resolve this issue. This patch is called ccba99b66bc61acf46e4a332034799d7452ddea6. Upgrading the affected component is advised.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-112104