Description
Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated POST /api/onboarding/oauth/start endpoint that allows unbounded accumulation of in-memory flow state and daemon threads. Attackers can send repeated or concurrent requests to exhaust server memory and thread resources, potentially triggering repeated outbound device-code requests to upstream OAuth providers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nesquena | hermes-webui | < 0.51.468 | 0.51.468 |
References
- hermes-webui v0.51.468 Release Notes release-notes
- Researcher Pull Request issue-tracking patch
- Maintainer Pull Request issue-tracking patch
- Patch Commit patch
- https://www.vulncheck.com/advisories/hermes-webui-resource-exhaustion-via-unauthenticated-oauth-flow-endpoint third-party-advisory