# CVE-2026-49955: nesquena Hermes WebUI resource exhaustion in passkey options endpoint

Source: https://junglewise.ai/threats/cve-2026-49955-nesquena-hermes-webui-resource-exhaustion-in-passkey-options  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-49955 · Severity: medium · CVSS 5.3 · Published 2026-06-09

Hermes WebUI, a web interface for managing AI models and services, is vulnerable to a resource exhaustion attack. An unauthenticated attacker can repeatedly request login options to force the server to perform excessive disk and processor work. This can lead to a denial-of-service condition, making the interface slow or completely unavailable for legitimate users.

Technologies: [Nesquena Hermes WebUI](https://junglewise.ai/threats/technologies/hermes-webui). Vendors: [Nesquena](https://junglewise.ai/threats/vendors/nesquena).

## Quick answers

**Is CVE-2026-49955 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49955 being exploited in the wild.

**How severe is CVE-2026-49955?** Medium severity, with a CVSS score of 5.3, published 9 June 2026.

**Which products and versions are affected?** Nesquena Hermes WebUI < 0.51.270.

**Is there a fix for CVE-2026-49955?** A patch was published on 2026-06-05: Fix merged in PR #3624 and released in v0.51.270 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49955 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-49955?** Check whether you run Nesquena Hermes WebUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A resource exhaustion vulnerability exists in the passkey authentication flow of Hermes WebUI. The `/api/auth/passkey/options` endpoint is public by design but lacked rate limiting or storage caps for pending WebAuthn challenges. An unauthenticated attacker can send unlimited POST requests to this endpoint, causing the server to repeatedly rewrite a JSON challenge store file. This results in unbounded growth of the `.passkey_challenges.json` file and excessive CPU and disk I/O. The vulnerability is mitigated in version 0.51.270 by implementing global and per-context challenge caps, process-local locking during file mutations, and returning HTTP 429 (Too Many Requests) when limits are reached.

## Affected products

- nesquena Hermes WebUI < 0.51.270

## Timeline

- 2026-06-05: patched: Fix merged in PR #3624 and released in v0.51.270
- 2026-06-09: disclosed: CVE-2026-49955 published

## References

- [https://github.com/nesquena/hermes-webui/commit/58528a4d88b0fa4f7b822e31d6051c669769bd3b](https://github.com/nesquena/hermes-webui/commit/58528a4d88b0fa4f7b822e31d6051c669769bd3b)
- [https://github.com/nesquena/hermes-webui/pull/3624](https://github.com/nesquena/hermes-webui/pull/3624)
- [https://github.com/nesquena/hermes-webui/pull/3674](https://github.com/nesquena/hermes-webui/pull/3674)
- [https://github.com/nesquena/hermes-webui/releases/tag/v0.51.270](https://github.com/nesquena/hermes-webui/releases/tag/v0.51.270)
- [https://www.vulncheck.com/advisories/hermes-webui-resource-exhaustion-via-passkey-options](https://www.vulncheck.com/advisories/hermes-webui-resource-exhaustion-via-passkey-options)

## Related threats

- [nesquena Hermes WebUI unauthenticated RCE in terminal API](https://junglewise.ai/threats/cve-2026-58123-nesquena-hermes-webui-unauthenticated-rce-in-terminal-api)
- [nesquena Hermes WebUI authorization bypass in session import](https://junglewise.ai/threats/cve-2026-58174-nesquena-hermes-webui-authorization-bypass-in-session-import)
- [nesquena Hermes WebUI authorization bypass in session export endpoint](https://junglewise.ai/threats/cve-2026-55198-nesquena-hermes-webui-authorization-bypass-in-session-export)
- [Hermes WebUI broken access control in /api/session endpoint](https://junglewise.ai/threats/cve-2026-55197-hermes-webui-broken-access-control-in-api-session-endpoint)
- [nesquena Hermes WebUI TOCTOU race condition in git_discard](https://junglewise.ai/threats/cve-2026-49958-nesquena-hermes-webui-toctou-race-condition-in-git-discard)