{"id":"CVE-2026-112104","state":"PUBLISHED","title":"eremef bandcamp-player Remote Control Server database.ts missing authentication","description":"A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. Executing a manipulation of the argument remoteEnabled can lead to missing authentication. The attack may be launched remotely. Upgrading to version 1.8.34-beta is sufficient to resolve this issue. This patch is called ccba99b66bc61acf46e4a332034799d7452ddea6. Upgrading the affected component is advised.","publishedAt":"2026-10-19T10:15:19.942Z","updatedAt":"2026-10-22T02:40:13.789Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X","source":"VulDB"},"assigner":"VulDB","products":["eremef bandcamp-player"],"affected":[{"vendor":"eremef","product":"bandcamp-player","versions":[{"version":"1.8.33-beta","status":"affected"},{"version":"1.8.34-beta","status":"unaffected"}],"cpes":["cpe:2.3:a:eremef:bandcamp-player:*:*:*:*:*:*:*:*"],"modules":["Remote Control Server"]}],"references":["https://vuldb.com/vuln/422045","https://vuldb.com/vuln/422045/cti","https://vuldb.com/cve/CVE-2026-112104","https://vuldb.com/submit/1013134","https://github.com/eremef/bandcamp-player/issues/104","https://github.com/eremef/bandcamp-player/pull/119","https://github.com/eremef/bandcamp-player/commit/ccba99b66bc61acf46e4a332034799d7452ddea6","https://github.com/eremef/bandcamp-player/releases/tag/v1.8.34-beta","https://github.com/eremef/bandcamp-player/"],"weaknesses":["CWE-306","CWE-287"],"ingestedAt":"2026-10-29T20:10:43.281Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/112xxx/CVE-2026-112104.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-112104","state":"PUBLISHED","datePublished":"2026-10-19T10:15:19.942Z","dateUpdated":"2026-10-22T02:40:13.789Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-10-18T17:56:04.315Z"},"containers":{"cna":{"title":"eremef bandcamp-player Remote Control Server database.ts missing authentication","descriptions":[{"lang":"en","value":"A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. Executing a manipulation of the argument remoteEnabled can lead to missing authentication. The attack may be launched remotely. Upgrading to version 1.8.34-beta is sufficient to resolve this issue. This patch is called ccba99b66bc61acf46e4a332034799d7452ddea6. Upgrading the affected component is advised."}],"affected":[{"vendor":"eremef","product":"bandcamp-player","versions":[{"version":"1.8.33-beta","status":"affected"},{"version":"1.8.34-beta","status":"unaffected"}],"cpes":["cpe:2.3:a:eremef:bandcamp-player:*:*:*:*:*:*:*:*"],"modules":["Remote Control Server"]}],"references":[{"url":"https://vuldb.com/vuln/422045","name":"VDB-422045 | eremef bandcamp-player Remote Control Server database.ts missing authentication","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/422045/cti","name":"VDB-422045 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-112104","name":"CVE-2026-112104 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/1013134","name":"Submit #1013134 | eremef bandcamp-player <= 1.8.33 Authentication Bypass","tags":["third-party-advisory"]},{"url":"https://github.com/eremef/bandcamp-player/issues/104","tags":["issue-tracking"]},{"url":"https://github.com/eremef/bandcamp-player/pull/119","tags":["issue-tracking","patch"]},{"url":"https://github.com/eremef/bandcamp-player/commit/ccba99b66bc61acf46e4a332034799d7452ddea6","tags":["patch"]},{"url":"https://github.com/eremef/bandcamp-player/releases/tag/v1.8.34-beta","tags":["patch"]},{"url":"https://github.com/eremef/bandcamp-player/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","type":"CWE","lang":"en","description":"Missing Authentication"}]},{"descriptions":[{"cweId":"CWE-287","type":"CWE","lang":"en","description":"Improper Authentication"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-10-19T10:15:19.942Z"},"timeline":[{"time":"2026-10-18T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-10-18T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-10-18T20:01:10.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"NeoWSY (VulDB User)","type":"reporter"}],"tags":["x_open-source"],"x_generator":["VulDB PVTS v202610"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-22T02:40:00.535603Z","id":"CVE-2026-112104","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-22T02:40:13.789Z"}}]}}}