CVE-2026-55205 describes a resource exhaustion vulnerability in nesquena's Hermes WebUI prior to version 0.51.468. The unauthenticated POST /api/onboarding/oauth/start endpoint does not limit or throttle resource allocation, enabling attackers to repeatedly or concurrently send requests that accumulate in-memory flow state and daemon threads without bounds. This can exhaust server memory and thread resources and may trigger repeated outbound device-code requests to OAuth providers. No official remediation or patch information is currently available.

Successful exploitation can lead to denial of service conditions by exhausting server memory and thread resources. This may disrupt normal operation of the Hermes WebUI and cause excessive outbound OAuth device-code requests, potentially impacting upstream OAuth providers. There is no indication of privilege escalation or data compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing external rate limiting or request throttling on the affected endpoint to mitigate resource exhaustion risks. Monitor for unusual request patterns targeting the /api/onboarding/oauth/start endpoint.