Live › vulnerability › CVE-2026-112104
Go to dashboardThe bandcamp-player desktop app's Remote Control Server can be switched on through the remoteEnabled setting without requiring authentication. A remote attacker who can reach the server can control the player without logging in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Users who run eremef bandcamp-player up to 1.8.33-beta with the Remote Control Server enabled and reachable from a network they do not fully trust. Installs with the remote control server disabled are not exposed by this flaw, as far as the sources describe.
No product ranges from the sources yet.
1.8.33-beta are affected.remoteEnabled).1.8.34-beta or later (patch commit ccba99b66bc61acf46e4a332034799d7452ddea6).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. Executing a manipulation of the argument remoteEnabled can lead to missing authentication. The attack may be launched remotely. Upgrading to version 1.8.34-beta is sufficient to resolve this issue. This patch is called ccba99b66bc61acf46e4a332034799d7452ddea6. Upgrading the affected component is advised.
This page as .md · .json · in your agent: get_signal("CVE-2026-112104")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.