PT-2026-48730 · Nesquena · Hermes-Webui

Published 2026-06-11 · Updated 2026-06-11 · CVE-2026-49973

Mitre

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated remote attackers to hijack initial setup by submitting the set password parameter to the settings API endpoint without any network origin restriction. Attackers on any reachable network can send a POST request to the settings endpoint during the first-run setup window to persist an arbitrary password hash, obtain a valid session cookie, and lock out the legitimate operator from their own instance.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-49973

Affected Products

Hermes-Webui

References · 6

• https://github.com/nesquena/hermes-webui/commit/1126e541325d401538f6a272a9c024c37d47ae08 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-49973 · Security Note
• https://github.com/nesquena/hermes-webui/releases/tag/v0.51.358 · Note
• https://github.com/nesquena/hermes-webui/pull/3973 · Note
• https://github.com/nesquena/hermes-webui/pull/3964 · Note
• https://vulncheck.com/advisories/hermes-webui-unauthenticated-password-takeover-via-api-settings · Note