CVE-2026-49955: Hermes WebUI DoS Vulnerability

CVE-2026-49955 Overview

CVE-2026-49955 is a resource exhaustion vulnerability in Hermes WebUI versions prior to 0.51.270. The flaw resides in the passkey options endpoint, which fails to limit unauthenticated requests for WebAuthn challenge generation. Remote attackers can send unlimited POST requests to this endpoint without ever completing the assertion step. Each request triggers a write to the challenge store file, causing unbounded file growth and excessive CPU and disk I/O from repeated JSON rewrites. The vulnerability is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
Unauthenticated attackers can degrade Hermes WebUI service availability by exhausting disk space and I/O bandwidth through trivial HTTP requests.

Affected Products

Hermes WebUI versions before 0.51.270
The passkey options authentication endpoint
Deployments exposing Hermes WebUI to untrusted networks

Discovery Timeline

2026-06-09 - CVE-2026-49955 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-49955

Vulnerability Analysis

The vulnerability resides in the WebAuthn passkey options handler exposed by Hermes WebUI. This endpoint generates a challenge for clients initiating passkey authentication. Each call persists the challenge to a JSON-backed store on disk. The handler does not require authentication, does not rate-limit callers, and does not expire stale challenges before persisting new ones. Attackers exploit this design by repeatedly invoking the endpoint without completing the assertion step. The challenge store grows without bound, and every write forces a full rewrite of the JSON file. The result is sustained CPU consumption, disk I/O saturation, and eventual storage exhaustion on the host running Hermes WebUI.

Root Cause

The root cause is missing throttling and unbounded resource allocation on an unauthenticated code path. The challenge store implementation rewrites the entire JSON document for each insertion, amplifying the impact of high request volume. No upper bound exists on stored challenges, and no eviction occurs when assertions are not completed.

Attack Vector

Attackers reach the vulnerable endpoint over the network with no credentials and no user interaction. A single host issuing concurrent POST requests to the passkey options endpoint can drive the target into a degraded state. The attack requires no special tooling beyond a standard HTTP client.

// Conceptual request pattern (no verified PoC available)
// Repeated unauthenticated POST requests to the passkey options endpoint
// trigger unbounded challenge store growth and JSON file rewrites.
// See the VulnCheck advisory for technical details.

Detection Methods for CVE-2026-49955

Indicators of Compromise

Rapid growth of the Hermes WebUI challenge store JSON file on disk
Sustained high volume of POST requests to the passkey options endpoint from a single source or small set of sources
Elevated CPU and disk I/O on the Hermes WebUI host without a corresponding spike in successful authentications

Detection Strategies

Monitor HTTP access logs for an abnormal ratio of passkey options requests to completed WebAuthn assertions
Alert on file size growth of the challenge store beyond expected operational baselines
Track unauthenticated request rates per source IP against the authentication endpoint

Monitoring Recommendations

Instrument the Hermes WebUI host with disk space and inode utilization alerts
Forward web server access logs to a centralized log platform for rate-based analytics
Baseline normal passkey enrollment and authentication volumes to detect deviation

How to Mitigate CVE-2026-49955

Immediate Actions Required

Upgrade Hermes WebUI to version 0.51.270 or later, which contains the upstream fix
Place the Hermes WebUI passkey endpoint behind a reverse proxy or web application firewall enforcing rate limits
Restrict network exposure of the authentication endpoint to trusted networks where feasible

Patch Information

The maintainers released the fix in Hermes WebUI v0.51.270. The remediation is implemented in commit 58528a4 and is covered by Pull Request #3624 and Pull Request #3674. Additional context is available in the VulnCheck advisory.

Workarounds

Apply request rate limiting at a reverse proxy in front of the passkey options endpoint
Cap the size of the challenge store file or its parent volume using filesystem quotas
Monitor and rotate or truncate the challenge store on a scheduled basis until the patch is applied

bash

# Example: nginx rate limit for the passkey options endpoint
limit_req_zone $binary_remote_addr zone=passkey:10m rate=5r/m;

server {
    location /passkey/options {
        limit_req zone=passkey burst=10 nodelay;
        proxy_pass http://hermes_webui_upstream;
    }
}