CVE Intelligence

Hermes-webui vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Hermes-webui products: 1 record(s), with severity, exploitation and fixes.

Hermes-webui 1

Exploited only (KEV) →

CVE-2026-55196 Critical · 9.1 CWE-306 Jun 17, 2026
Hermes WebUI < 0.51.409 - Unauthenticated Passkey Registration via Authentication Bypass
Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication, allowing attackers to claim the first passkey and gain permanent administrative control.