nesquena hermes-webui up to 0.51.269 Passkey Options Endpoint allocation of resources

Summaryinfo

A vulnerability, which was classified as problematic, has been found in nesquena hermes-webui up to 0.51.269. The affected element is an unknown function of the component Passkey Options Endpoint. The manipulation leads to allocation of resources. This vulnerability is documented as CVE-2026-49955. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in nesquena hermes-webui up to 0.51.269. It has been rated as problematic. This issue affects an unknown functionality of the component Passkey Options Endpoint. The manipulation with an unknown input leads to a allocation of resources vulnerability. Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. Impacted is availability. The summary by CVE is:

Hermes WebUI before version 0.51.270 contains a resource exhaustion vulnerability that allows unauthenticated remote attackers to degrade service availability by repeatedly calling the passkey options endpoint without completing assertion. Attackers can send unlimited POST requests to the authentication endpoint, causing unbounded growth of the challenge store file and excessive CPU and disk I/O through repeated JSON file rewrites.

The weakness was released by Chia Min Jun Lennon. The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-49955 since 06/02/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 0.51.270 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 58528a4d88b0fa4f7b822e31d6051c669769bd3b is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• nesquena

Name

• hermes-webui

Version

• 0.51.269

License

• open-source

Website

• Product: https://github.com/nesquena/hermes-webui/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion