Resource Exhaustion Vulnerability in Hermes WebUI by Nesquena

CVE-2026-55205

What is CVE-2026-55205?

The Hermes WebUI, prior to version 0.51.468, is susceptible to a resource exhaustion vulnerability via the unauthenticated POST /api/onboarding/oauth/start endpoint. This flaw allows attackers to flood the server with repeated or concurrent requests, leading to significant in-memory flow state and daemon thread accumulation. Consequently, this can result in the exhaustion of server memory and thread resources, prompting excessive outbound device-code requests to upstream OAuth providers. Addressing this vulnerability is crucial to maintaining server integrity and performance.

References