Read the docs
TI-2026-36798 Aliases CVE-2026-49955GHSA-wwx5-jq7h-rp7v

Hermes WebUI < 0.51.270 Resource Exhaustion via passkey/options

Priority LOW 37CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

Hermes WebUI before version 0.51.270 contains a resource exhaustion vulnerability that allows unauthenticated remote attackers to degrade service availability by repeatedly calling the passkey options endpoint without completing assertion. Attackers can send unlimited POST requests to the authentication endpoint, causing unbounded growth of the challenge store file and excessive CPU and disk I/O through repeated JSON file rewrites.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00586 48th percentileScored 2026-11-07
Fix Fixed hermes-webui (nesquena): 0.51.270

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nesquenahermes-webuibefore 0.51.2700.51.270Patch availableCNA
  • hermes-webui Vendornesquena Affected before 0.51.270 Fixed in 0.51.270 Patch available CNA

Remediation

  • Fix · CNA hermes-webui (nesquena) Fixed in 0.51.270

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49955
  2. 2026-10-03 Alias added: GHSA-wwx5-jq7h-rp7v
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 1

Other 3

  • TI-2026-36807 Hermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settings CVSS 4.0CRITICAL 9.2
  • TI-2026-39885 Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint CVSS 4.0MEDIUM 6.9
  • TI-2026-39878 Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint CVSS 4.0HIGH 7.1
  • TI-2026-39877 Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint CVSS 4.0HIGH 7.1
  • TI-2026-36799 Hermes WebUI < 0.51.269 Profile Isolation Bypass via sessions search CVSS 4.0HIGH 7.1
  • TI-2026-09773 Hermes WebUI before 0.51.221 Path Traversal via Symlink Workspace Bypass CVSS 4.0HIGH 7.1
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences