A race condition exists in the DAAP login handler of Owntone Server that allows an unauthenticated attacker to crash the server. The flaw arises from unsynchronized access to a global DAAP session list when multiple concurrent login requests are processed at the same time. Exploiting this race condition causes the server to terminate unexpectedly, resulting in a denial of service.

Owntone Server versions 28.4 through 29.0 are affected. The issue does not apply to version 29.1 or later, which contain the fix.

The vulnerability carries a CVSS score of 8.2, indicating a high severity. The EPSS score is not available, but the high CVSS suggests a notable risk of exploitation. Attackers can trigger the condition by flooding the /login endpoint with simultaneous requests; no authentication is required. The vulnerability is not listed in the CISA KEV catalog, but its impact as a remote denial of service remains significant.