---
id: CVE-2026-112104
title: >-
  eremef bandcamp-player Remote Control Server database.ts missing
  authentication
summary: >-
  A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The
  impacted element is an unknown function of the file database.ts of the
  component Remote Control Server. Executing a manipulation of the argument
  remoteEnabled can lea…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-306
  - CWE-287
vendor: eremef
product: bandcamp-player
affected:
  - bandcamp-player 1.8.33-beta
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T10:15:19.942Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112104'
references:
  - url: 'https://vuldb.com/vuln/422045'
    label: >-
      VDB-422045 | eremef bandcamp-player Remote Control Server database.ts
      missing authentication
  - url: 'https://vuldb.com/vuln/422045/cti'
    label: 'VDB-422045 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-112104'
    label: CVE-2026-112104 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1013134'
    label: 'Submit #1013134 | eremef bandcamp-player <= 1.8.33 Authentication Bypass'
  - url: 'https://github.com/eremef/bandcamp-player/issues/104'
  - url: 'https://github.com/eremef/bandcamp-player/pull/119'
  - url: >-
      https://github.com/eremef/bandcamp-player/commit/ccba99b66bc61acf46e4a332034799d7452ddea6
  - url: 'https://github.com/eremef/bandcamp-player/releases/tag/v1.8.34-beta'
  - url: 'https://github.com/eremef/bandcamp-player/'
tags:
  - cve.org
ingestedAt: '2026-10-19T12:27:23.822Z'
---

## Overview

A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. Executing a manipulation of the argument remoteEnabled can lead to missing authentication. The attack may be launched remotely. Upgrading to version 1.8.34-beta is sufficient to resolve this issue. This patch is called ccba99b66bc61acf46e4a332034799d7452ddea6. Upgrading the affected component is advised.

## Affected

- `bandcamp-player 1.8.33-beta`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.