CVE-2026-41458 is a race condition vulnerability (CWE-362) in the OwnTone Server's DAAP login handler affecting versions 28.4 through 29.0. The vulnerability results from improper synchronization when accessing the global DAAP session list, enabling unauthenticated attackers to trigger a denial of service by flooding the /login endpoint with concurrent requests. This leads to a server crash due to concurrent execution issues. The CVSS 4.0 score is 8.2, indicating high severity, with attack vector network, high attack complexity, no privileges or user interaction required, and high impact on availability. No patch or official remediation has been disclosed as of the published date.

An attacker can remotely cause a denial of service condition on the OwnTone Server by exploiting a race condition in the DAAP login handler. This results in a server crash without requiring authentication, potentially disrupting service availability for legitimate users. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting access to the DAAP /login endpoint or implementing rate limiting to reduce the risk of exploitation. Monitor for updates from the OwnTone project regarding patches or mitigations.