Summary
generated automatically from NVD dataeremef bandcamp-player, up to version 1.8.33-beta, has a missing authentication flaw in the Remote Control Server component. An unknown function in database.ts mishandles the remoteEnabled argument, so a remote attacker could reach the server without authenticating. The issue is rated 7.3 (HIGH) under CVSS v3.1, and the description says upgrading to version 1.8.34-beta resolves it.
NVD description
A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. Executing a manipulation of the argument remoteEnabled can lead to missing authentication. The attack may be launched remotely. Upgrading to version 1.8.34-beta is sufficient to resolve this issue. This patch is called ccba99b66bc61acf46e4a332034799d7452ddea6. Upgrading the affected component is advised.
CVSS v3.1 Score
Information
- Published
- 19 oct. 2026
- Updated
- 19 oct. 2026
- Status
- Deferred
- Source
- cna@vuldb.com
Weaknesses (CWE)
References (9)
Similar CVEs
Other vulnerabilities of type CWE-287
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.