A flaw in eremef bandcamp-player allows an unauthenticated attacker to manipulate the remoteEnabled argument in the Remote Control Server’s database.ts component, bypassing the authentication checks that normally guard privileged remote control actions. The missing authentication is categorized as CWE‑287 and CWE‑306, indicating that the code fails to verify user identity before proceeding. As a result, an attacker with network access to the Remote Control Server endpoint can override the remoteEnabled flag, effectively granting themselves authorized control over the server and potentially compromising the system’s integrity and confidentiality.

The vulnerability affects eremef bandcamp-player versions up to and including 1.8.33‑beta. The specific component impacted is the Remote Control Server’s database.ts file. The issue is resolved in release v1.8.34‑beta, which incorporates commit ccba99b66bc61acf46e4a332034799d7452ddea6. No other product variants are reported as affected.

The CVSS score is 6.9, indicating moderate severity. EPSS is not available, but the issue is exploitable remotely, and the attack vector is inferred as network‑based because the flaw lies in the Remote Control Server. The vulnerability is not listed in the CISA KEV catalog, but the potential for unauthorized control makes it a relevant risk for operators who enable the remote control feature.