CVE-2026-112104
Received Received - Intake

Authentication Bypass in Eremef Bandcamp-Player

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. Executing a manipulation of the argument remoteEnabled can lead to missing authentication. The attack may be launched remotely. Upgrading to version 1.8.34-beta is sufficient to resolve this issue. This patch is called ccba99b66bc61acf46e4a332034799d7452ddea6. Upgrading the affected component is advised.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112104
EUVD
EUVD-2026-104219

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
eremef bandcamp-player 1.8.33-beta

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Bandcamp Player application up to version 1.8.33-beta. It involves a remote-control WebSocket server enabled by default that listens on all network interfaces without authentication. Attackers on the same local network can remotely control the app, manipulate playback, access user data, modify playlists, or fetch arbitrary URLs.

Detection Guidance

Check if the Bandcamp Player application is running and listening on port 9999 across all network interfaces. Use commands like 'netstat -tulnp | grep 9999' on Linux or 'netstat -ano | findstr 9999' on Windows to detect the open port. Verify if the remote control feature is enabled without authentication by inspecting application logs or settings.

Impact Analysis

An attacker on your local network could take control of your Bandcamp Player, play unwanted content, access your playlists or collections, delete playlists, or use your app to fetch malicious URLs. This could lead to privacy breaches or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles or HIPAA's safeguards for protected health information. Unauthorized remote control may also breach compliance requirements for data integrity and access controls.

Mitigation Strategies

Upgrade the Bandcamp Player to version 1.8.34-beta or later to address the forced re-enable issue. Disable the remote control feature if not needed. Bind the remote server to localhost only instead of all interfaces. Enable secure pairing mode and enforce authentication for remote connections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112104. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart