CVE-2026-55205
Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint
CVSS 4.0 6.9 MEDIUMCVSS 3.1 5.3 MEDIUMCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-55205
PublishedHermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated POST /api/onboarding/oauth/start endpoint that allows unbounded accumulation of in-memory flow state and daemon threads. Attackers can send repeated or concurrent requests to exhaust server memory and thread resources, potentially triggering repeated outbound device-code requests to upstream OAuth providers.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-55205 · CVE overview and exploitation status
cve-program · CVE-2026-55205
- https://github.com/nesquena/hermes-webui/releases/tag/v0.51.468
- https://github.com/nesquena/hermes-webui/pull/3970
- https://github.com/nesquena/hermes-webui/pull/4338
- https://github.com/nesquena/hermes-webui/commit/ce272d9cd5f8e5a4521278f56eb5388010901646
- https://www.vulncheck.com/advisories/hermes-webui-resource-exhaustion-via-unauthenticated-oauth-flow-endpoint
Related changes
Linked by CVE identifierNo related changes are available here.