Authentication Bypass in eremef bandcamp-player

A security vulnerability identified as CVE-2026-112104 affects the eremef bandcamp-player software package in versions up to and including 1.8.33-beta. The flaw resides within the Remote Control Server component, specifically in an undisclosed function within the database.ts file. An attacker can exploit this by manipulating the remoteEnabled argument, leading to a bypass of authentication mechanisms. Because the attack can be executed remotely, it poses a significant risk to the integrity of affected systems. The vulnerability is resolved in version 1.8.34-beta, which includes the fix referenced by commit ccba99b66bc61acf46e4a332034799d7452ddea6. Organizations utilizing this package are urged to update to the latest version to prevent unauthorized remote access to the Remote Control Server.

Impact

Successful exploitation allows an unauthenticated remote attacker to bypass authentication controls within the Remote Control Server. This could lead to unauthorized administrative access or control over the server functionality, potentially enabling further exploitation or data exposure depending on the specific implementation of the remote control features.

Recommendation

Update the eremef bandcamp-player component to version 1.8.34-beta or later immediately. Ensure that the Remote Control Server feature is not exposed to untrusted networks until the software has been patched to the remediated version.