| Title | eremef bandcamp-player <= 1.8.33 Authentication Bypass |
|---|
| Description | bandcamp-player (eremef/bandcamp-player, published as "Beta Player", an Electron desktop client for bandcamp.com) enables an HTTP+WebSocket remote-control server by default, bound to x.x.x.x:9999, with no client authentication, no Origin check and no pairing (CWE-306). The remoteEnabled setting defaults to true (database.ts:202) and a user-disabled value is silently force-re-enabled at startup (database.ts:242-245, "Force enable remote for debugging/setup"); main.ts:274-275 starts the service whenever the flag is set.
Any device on the same LAN can connect unauthenticated and: (1) fully control the player (transport/volume/queue); (2) read user data via get-playlists/get-collection/get-artists (remote.service.ts:323/:466/:494); (3) create, update or delete playlists, including the destructive delete-playlist (:525); (4) make the victim's main process fetch attacker-supplied URLs - the four WebSocket commands (play-album :570, play-bandcamp-playlist :583, get-bandcamp-playlist-tracks :596, get-album :605) only require the payload string to start with "http", giving a LAN peer a server-side request pivot to intranet addresses with read-back of the fetched content.
Verified live on a fresh default install of v1.8.33-beta (official Windows x64 release, zero configuration): the process listens on x.x.x.x:9999, a WebSocket handshake carrying a hostile Origin header is accepted, unauthenticated control and data-read commands are answered, and the main process fetched an attacker-specified URL within 10 ms (attacker-side listener capture).
Affected: v1.2.0-beta (2026-01-26, first release containing remote.service.ts) through v1.8.33-beta (latest). Fix: v1.8.34 partially addresses the issue (the vendor-described change is "dropped forced remote re-enable"); the unauthenticated remote service remains reachable when explicitly enabled. Suggested fixes: bind to 127.0.0.1 unless LAN exposure is explicitly opted in, validate the Origin header, or require a pairing token.
CVSS v3.1: AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L = 6.3 (Medium). No prior CVE: NVD keyword "bandcamp" 0 results; GitHub advisories for eremef/bandcamp-player: 0.
Source note: description assembled from the project case file (CNA-LR request 2099980, field-mappings bandcamp.json) and the batch kit; no separate h01 report file exists under F:\1day-ops\0day-hunts. |
|---|
| Source | ⚠️ https://github.com/eremef/bandcamp-player/issues/104 |
|---|
| User | NeoWSY (UID 82976) |
|---|
| Submission | 10/04/2026 15:44 (27 days ago) |
|---|
| Moderation | 10/18/2026 19:56 (14 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422045 [eremef bandcamp-player up to 1.8.33-beta Remote Control Server database.ts remoteEnabled missing authentication] |
|---|
| Points | 20 |
|---|