This vulnerability is found in MPD Player Panels (v2 - v3) & Universal DRM Player
Screenshot:
Patch is to secure the graphql api with an authentification token.
This code will try to retrieve only the users & passwords list, no streams.
Do not harm or use it against people.