Medium severity5.3NVD Advisory· Published Jun 9, 2026· Updated Jun 9, 2026
CVE-2026-49955
CVE-2026-49955
Description
Hermes WebUI before version 0.51.270 contains a resource exhaustion vulnerability that allows unauthenticated remote attackers to degrade service availability by repeatedly calling the passkey options endpoint without completing assertion. Attackers can send unlimited POST requests to the authentication endpoint, causing unbounded growth of the challenge store file and excessive CPU and disk I/O through repeated JSON file rewrites.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <0.51.270
Patches
Vulnerability mechanics
References
5- github.com/nesquena/hermes-webui/commit/58528a4d88b0fa4f7b822e31d6051c669769bd3bnvd
- github.com/nesquena/hermes-webui/pull/3624nvd
- github.com/nesquena/hermes-webui/pull/3674nvd
- github.com/nesquena/hermes-webui/releases/tag/v0.51.270nvd
- www.vulncheck.com/advisories/hermes-webui-resource-exhaustion-via-passkey-optionsnvd
News mentions
0No linked articles in our index yet.