Bandcamp Player
Monthly
Missing authentication in the Remote Control Server component of eremef bandcamp-player through 1.8.33-beta allows unauthenticated attackers with LAN reachability to control the desktop player's remote interface without a device pairing or approval step. The flaw is rooted in how the remoteEnabled setting is handled in database.ts, and it is practically exposed only when the Remote Control feature is switched on and the legacy, non-secure connection mode (plain HTTP/WS, no pairing) is in use; no victim interaction is required against such a server. No public exploit code or active exploitation has been confirmed, and the vendor has released a patched version, 1.8.34-beta, which turns Secure Mode (HTTPS/WSS with QR pairing and desktop approval) on by default.
Missing authentication in the Remote Control Server component of eremef bandcamp-player through 1.8.33-beta allows unauthenticated attackers with LAN reachability to control the desktop player's remote interface without a device pairing or approval step. The flaw is rooted in how the remoteEnabled setting is handled in database.ts, and it is practically exposed only when the Remote Control feature is switched on and the legacy, non-secure connection mode (plain HTTP/WS, no pairing) is in use; no victim interaction is required against such a server. No public exploit code or active exploitation has been confirmed, and the vendor has released a patched version, 1.8.34-beta, which turns Secure Mode (HTTPS/WSS with QR pairing and desktop approval) on by default.