Vulnerability · Published Jun 18, 2026 · Assigned by VulnCheck

CVE-2026-55205Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint

Medium 5.3

In plain English

A medium-severity resource allocation without limits in hermes-webui from nesquena. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 55.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated POST /api/onboarding/oauth/start endpoint that allows unbounded accumulation of in-memory flow state and daemon threads. Attackers can send repeated or concurrent requests to exhaust server memory and thread resources, potentially triggering repeated outbound device-code requests to upstream OAuth providers.

Affected products (as reported)

Vendor	Product	Versions
nesquena	hermes-webui	0 – before 0.51.468

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

hermes-webui v0.51.468 Release Notes release-notes
Researcher Pull Request issue-tracking, patch
Maintainer Pull Request issue-tracking, patch
Patch Commit patch
https://www.vulncheck.com/advisories/hermes-webui-resource-exhaustion-via-unauthenticated-oauth-flow-endpoint third-party-advisory