CVE-2026-55205: Hermes WebUI Resource Exhaustion in Unauthenticated OAuth Endpoint

Technical summary

CVE-2026-55205 is a resource exhaustion vulnerability (CWE-770) in the unauthenticated POST /api/onboarding/oauth/start endpoint in Hermes WebUI. The endpoint accumulates in-memory flow state and spawns daemon threads without bounds on concurrent requests or lifetime. Attackers can send high volumes of requests—either sequentially or in parallel—to trigger unbounded accumulation of these resources. Because the endpoint initiates device-code flows against upstream OAuth providers, repeated exploitation also generates outbound request load against those external services. The vulnerability requires no authentication or user interaction, making it trivially accessible over the network.

Business impact

Resource exhaustion on Hermes WebUI can degrade or disable user authentication and onboarding workflows. If the service is a critical identity or API gateway component, prolonged unavailability will block end-user access to downstream applications. Organizations relying on Hermes for OAuth-based SSO face user lockout scenarios. Secondary impact includes unexpected load spikes against upstream OAuth providers (such as corporate identity systems or third-party services), which may trigger rate-limiting or alerting on those providers and reveal that your infrastructure is under attack.

Affected systems

Hermes WebUI versions before 0.51.468 are affected. The vulnerability is present in all unauthenticated deployments of affected versions. Organizations using Hermes as an authentication or onboarding proxy—whether for internal SSO or public-facing OAuth integrations—should inventory their deployment versions and assess exposure based on network accessibility of the /api/onboarding/oauth/start endpoint.

Exploitability

Exploitability is high relative to access barriers: the endpoint is unauthenticated, requires no special capabilities, and is trivial to invoke. An attacker needs only network access to the Hermes service and a basic HTTP client. Attack volume can be generated from a single source or distributed across multiple IPs. The impact (denial of service) occurs rapidly under moderate concurrency (tens to hundreds of simultaneous requests), making this suitable for low-sophistication attack scenarios. However, active exploitation is not currently tracked in public exploit databases, and the CVSS score of 5.3 (Medium) reflects that availability impact is the sole consequence—there is no confidentiality or integrity breach.

Remediation

Upgrade Hermes WebUI to version 0.51.468 or later. The patched version should implement request rate-limiting, request queuing, or resource pooling on the /api/onboarding/oauth/start endpoint to prevent unbounded resource accumulation. Organizations unable to patch immediately should implement network-level controls: place the Hermes instance behind a WAF or reverse proxy configured to rate-limit POST requests to that endpoint, or restrict network access to the onboarding endpoint to trusted source IPs if the onboarding flow is not intended for public use.

Patch guidance

Verify the current version of Hermes WebUI running in your environment (check logs, config files, or the application's admin interface for version information). Download and review the vendor advisory for version 0.51.468 to confirm that this version contains the fix for CVE-2026-55205. Test the patch in a staging environment, particularly around the /api/onboarding/oauth/start endpoint, to ensure that OAuth device-code flows still function normally and that upstream OAuth provider requests are not adversely affected. After validation, schedule upgrades during a maintenance window to minimize user impact.

Detection guidance

Monitor for signs of resource exhaustion on Hermes WebUI instances: check CPU, memory, and thread count metrics for sustained spikes correlated with incoming HTTP traffic. Log or alert on high-frequency POST requests to /api/onboarding/oauth/start within a short time window (e.g., >50 requests per minute from a single source or >200 globally). Examine upstream OAuth provider logs for unexpected spikes in device-code requests originating from your Hermes infrastructure. Search access logs for patterns of repeated requests to the /api/onboarding/oauth/start endpoint with HTTP 200 or 5xx responses; rapid sequences may indicate active exploitation. Correlate these signals with user reports of authentication or onboarding delays.

Why prioritize this

This vulnerability merits prompt remediation because the attack surface is unauthenticated and accessible from the network, the exploitation is straightforward, and the impact (denial of service) can block critical authentication workflows. Although the CVSS score is Medium (5.3) and there is no confidentiality or integrity impact, the functional severity for organizations relying on Hermes for user authentication is higher. Prioritize patching for internet-facing or shared-infrastructure Hermes instances; internal onboarding-only deployments with limited user onboarding frequency may have lower priority but should still be scheduled.

Risk score, explained

The CVSS:3.1 score of 5.3 (Medium severity) reflects: Network-accessible attack vector (AV:N), Low attack complexity (AC:L), no privilege or user interaction required (PR:N, UI:N), limited scope (S:U), zero confidentiality or integrity impact (C:N, I:N), and low availability impact (A:L—service degradation rather than complete outage). The 'Low' availability score acknowledges that a successful attack causes denial of service but does not necessarily result in permanent data loss or total system compromise. In operational terms, availability damage can be substantial for an authentication service, so security teams should weight this above the base score when prioritizing fixes for identity infrastructure.

Frequently asked questions