CVE-2026-55196
Hermes WebUI < 0.51.409 - Unauthenticated Passkey Registration via Authentication Bypass
CVSS Score
9.1
EPSS Score
0.0%
EPSS Percentile
0th
Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication, allowing attackers to claim the first passkey and gain permanent administrative control.
| CWE | CWE-306 |
| Vendor | hermes-webui |
| Product | hermes-webui |
| Published | Jun 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for hermes-webui hermes-webui
Be the first to know when new critical vulnerabilities affecting hermes-webui hermes-webui are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
hermes-webui / hermes-webui
0 < 0.51.409
References
github.com: https://github.com/nesquena/hermes-webui/releases/tag/v0.51.442 github.com: https://github.com/nesquena/hermes-webui/pull/4171 github.com: https://github.com/nesquena/hermes-webui/pull/4267 github.com: https://github.com/nesquena/hermes-webui/commit/4d90577e25d5537cb07290eca3fb8abff3bab316 vulncheck.com: https://www.vulncheck.com/advisories/hermes-webui-unauthenticated-passkey-registration-via-authentication-bypass
Credits
Chia Min Jun Lennon