Hermes WebUI EUVD-2026-37904

The POST /api/onboarding/oauth/start endpoint must be reachable over the network - this is its default exposure in Hermes WebUI before 0.51.468, as the endpoint is explicitly unauthenticated (PR:N per the CVSS 4.0 vector). No authentication, session token, or prior account registration is required. The attack requires sending repeated or concurrent POST requests; a single request is benign. What limits exploitation in practice: (1) the attacker must have network-layer access to the Hermes WebUI port - deployments behind an authenticated reverse proxy, VPN, or IP allowlist are not directly exposed to unauthenticated remote exploitation; (2) the availability impact is scoped to the Hermes WebUI service process itself, not the underlying host OS or other co-located applications unless they share OS-level thread or memory limits; (3) the secondary OAuth provider rate-limiting effect only materializes if valid provider/profile parameters are supplied in the requests.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N, score 6.9) characterizes this as a moderate-severity network-accessible unauthenticated DoS with low availability impact on the vulnerable system. The AV:N and PR:N metrics are consistent with the description: the endpoint is explicitly unauthenticated and reachable over HTTP. The VA:L rating may reflect that degradation rather than immediate full crash is the typical outcome. However, in practice, unbounded thread and heap growth from a sustained request flood can escalate to complete service unavailability, which would merit VA:H - this discrepancy should be verified against vendor-supplied load testing data. No EPSS data was provided. The vulnerability is not in CISA KEV and no public exploit code exists at time of analysis. For organizations with Hermes WebUI exposed to untrusted networks, real-world risk is meaningfully elevated beyond the moderate score because the attack surface is zero-friction: any HTTP client capable of sending concurrent requests can trigger the condition. A secondary risk not captured in the CVSS vector is that repeated outbound device-code requests to upstream OAuth providers (e.g., Google, GitHub) may trigger provider-side rate limiting or temporary lockouts affecting legitimate user onboarding.

An unauthenticated attacker targeting a publicly accessible Hermes WebUI deployment sends a high-concurrency flood of POST requests to /api/onboarding/oauth/start - achievable with common HTTP benchmarking tools - causing the server to allocate a new in-memory flow object and spawn a daemon polling thread for each request. As heap and thread pool resources deplete, the Hermes WebUI process becomes unresponsive to legitimate users, and simultaneous outbound device-code calls to configured OAuth providers may trigger upstream rate limiting, compounding the denial-of-service effect. No public exploit code exists at time of analysis, but the attack requires no authentication or special tooling beyond a concurrent HTTP client.