PT-2026-50521 · Hermes Webui · Hermes-Webui

Published 2026-06-17 · Updated 2026-06-17 · CVE-2026-55196

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Hermes WebUI versions prior to 0.51.409

Description An authentication bypass exists in passkey registration endpoints. When HERMES WEBUI PASSKEY=1 is enabled and no credentials exist, unauthenticated remote attackers can register arbitrary passkeys. This occurs because the endpoints 'POST /api/auth/passkey/register/options' and 'POST /api/auth/passkey/register' are accessible without authentication, potentially allowing an attacker to claim the first passkey and obtain permanent administrative control.

Recommendations Update to version 0.51.409 or later.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-55196

Affected Products

Hermes-Webui

References · 6

• https://github.com/nesquena/hermes-webui/commit/4d90577e25d5537cb07290eca3fb8abff3bab316 · Patch
• https://github.com/nesquena/hermes-webui/pull/4171 · Note
• https://github.com/nesquena/hermes-webui/releases/tag/v0.51.442 · Note
• https://github.com/nesquena/hermes-webui/pull/4267 · Note
• https://twitter.com/CVEnew/status/2067350994501922921 · Twitter Post
• https://vulncheck.com/advisories/hermes-webui-unauthenticated-passkey-registration-via-authentication-bypass · Note