Bandcamp Player CVE-2026-112104

Requires the Remote Control Server feature to be enabled on the bandcamp-player desktop app and the attacker to be able to reach that server over the network - per vendor documentation this is a local-network (LAN) companion-app feature, not a public internet service. The flaw lies in authentication handling tied to the remoteEnabled argument in database.ts, affecting the legacy non-secure connection mode (plain HTTP/WS without device pairing or approval). Limiting factors: the remote control feature must be turned on; exploitation is practically constrained to the trusted LAN; and the fix (v1.8.34-beta) ships Secure Mode (HTTPS/WSS with pairing and desktop approval) enabled by default, so patched/default deployments are not exposed. No user interaction on the victim side and no authentication are required against a vulnerable, enabled server.

This is a medium-severity (CVSS 4.0 base 6.9) missing-authentication flaw (CWE-306) in the Remote Control Server of eremef bandcamp-player, reported solely by VulDB. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) indicates a low-complexity, unauthenticated attack with only partial (Low) impact across confidentiality, integrity, and availability. Exploitation maturity is E:X (undefined); there is no CISA KEV listing, no EPSS value supplied, and no public exploit identified, so this reflects a disclosed-and-patched issue rather than an actively exploited one. A key tension: the vector and description claim network/remote reach (AV:N, 'launched remotely'), but the vendor's own README and REMOTE_SPEC describe the remote control server as a LAN-scoped feature for pairing a phone to the desktop - 'other devices on your local network may read traffic or control playback' - which implies adjacent-network (LAN) rather than true internet-remote exposure. Net real-world priority is LOW-to-MEDIUM: partial impact, likely LAN-bound, obscure product, no exploitation evidence. Treat it as a routine upgrade rather than an emergency, while verifying actual network exposure of the remote control port.

A user runs the bandcamp-player desktop app with Remote Control enabled in legacy (non-secure) mode. An attacker on the same local network sends requests to the remote control server and, because the remoteEnabled handling lacks an authentication/pairing check, gains unauthenticated control of playback and read access to player state without approval on the desktop. No public exploit code has been identified at time of analysis.