OwnTone Server < 29.1 Race Condition DoS via DAAP Login

The primary impact of CVE-2026-41458 is a denial of service. An attacker can easily disrupt OwnTone Server functionality by sending a high volume of requests to the /login endpoint. This can render the server unavailable to legitimate users, impacting media streaming and other services provided by OwnTone. The lack of authentication required for exploitation significantly lowers the barrier to entry for attackers, making this vulnerability a serious concern. Successful exploitation doesn't lead to data exfiltration or code execution, but the service disruption can be significant, especially in environments where OwnTone Server is critical for media management or distribution.

Organizations and individuals relying on OwnTone Server for media management and streaming are at risk. This includes users of older OwnTone Server installations who have not yet applied security updates. Shared hosting environments where OwnTone Server is deployed could be particularly vulnerable, as an attacker could potentially target the server from another tenant's account.

• nodejs / server: Monitor OwnTone Server logs for a high volume of requests to the /login endpoint originating from a single IP address or a small number of IP addresses. Use journalctl -f to observe login attempts and resource usage.

journalctl -f | grep "/login"

• generic web: Use curl to send a large number of concurrent requests to the /login endpoint and monitor server response times and resource utilization.

curl -v -H 'Accept: application/json' -X POST http://<ownToneServerIP>/login --parallel --limit 100

1. 2026-04-22Disclosure

   disclosure

1. Gereserveerd2026-04-20
2. Gepubliceerd2026-04-22
3. EPSS bijgewerkt2026-04-29

The recommended mitigation for CVE-2026-41458 is to immediately upgrade OwnTone Server to version 29.1.0 or later. If upgrading is not immediately feasible, consider implementing rate limiting on the /login endpoint to restrict the number of concurrent requests from a single IP address. Web application firewalls (WAFs) can be configured to detect and block suspicious traffic patterns indicative of a DoS attack. Monitoring server resource utilization (CPU, memory) can help identify potential DoS attacks in progress. After upgrading, confirm the fix by attempting to flood the /login endpoint with concurrent requests and verifying that the server remains stable.