CVE-2026-55205: Nesquena Hermes-Webui

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated POST /api/onboarding/oauth/start endpoint that allows unbounded accumulation of in-memory flow state and daemon threads. Attackers can send repeated or concurrent requests to exhaust server memory and thread resources, potentially triggering repeated outbound device-code requests to upstream OAuth providers.

Affected products

• Nesquena Hermes-Webui: before 0.51.468 (fixed in 0.51.468)

Published 2026-06-18. Last modified 2026-09-17.