OwnTone Server CVE-2026-41457

The DAAP query and filter endpoints must be network-accessible (default configuration for OwnTone Server in listening mode). The exploit requires that integer-mapped DAAP fields are used in the query= or filter= parameters; attacks targeting text-only fields may require different injection syntax but the underlying vulnerability remains. No authentication is required. Exploitation succeeds against default installations where DAAP is enabled and network-accessible; if DAAP is explicitly disabled or firewalled to localhost-only, the vulnerability cannot be exploited remotely. The attacker must craft syntactically valid SQL injection payloads appropriate to the underlying SQL dialect used by OwnTone Server (likely SQLite); the effectiveness depends on database-specific function availability.

CVSS 6.9 (AV:N/AC:L/PR:N/UI:N) indicates a network-accessible vulnerability requiring no authentication or user interaction-a high baseline. However, the CVSS scope is confined (S:X implies no scope escalation), and the impact is low confidentiality and integrity impact (VC:L/VI:L/VA:N), meaning attackers can read and potentially modify media metadata but not execute arbitrary code or cause service denial. The vulnerability is NOT confirmed in CISA KEV, and POC availability is not stated in the provided data. Real-world risk is moderate: while any SQL injection warrants urgent patching, the impact is limited to unauthorized data access within the media library context rather than system-level compromise. An attacker cannot directly execute code or crash the service via this vector. Authentication bypass is achievable because DAAP queries are typically made by unauthenticated clients on the local network or exposed internet. The lack of active exploitation signals (no KEV, no confirmed POC) and the low severity impact mitigate against treating this as critical, but the trivial attack complexity and zero privilege requirement demand rapid patching in exposed deployments.

An attacker sends a crafted HTTP GET request to the OwnTone Server DAAP endpoint with a malicious query parameter such as query=title:*' OR '1'='1, causing the server to construct an invalid SQL WHERE clause. The injected OR expression bypasses intended filter logic, returning all media items regardless of the intended query constraint. The attacker can further enumerate database structure using UNION-based injection or time-based blind injection techniques to extract sensitive metadata or confirm the vulnerability. No user interaction is required; a simple HTTP client suffices.