CVE-2026-55196
CRITICALHermes WebUI < 0.51.409 - Unauthenticated Passkey Registration via Authentication Bypass
Title source: cnaDescription
Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication, allowing attackers to claim the first passkey and gain permanent administrative control.
References (5)
Core 5
Core References
Release Notes release-notes
Release Notes
https://github.com/nesquena/hermes-webui/releases/tag/v0.51.442
Technical Description technical-description
Researcher Pull Request
https://github.com/nesquena/hermes-webui/pull/4171
Issue Tracking issue-tracking
Maintainer Pull Request
https://github.com/nesquena/hermes-webui/pull/4267
Patch patch
Patch Commit
https://github.com/nesquena/hermes-webui/commit/4d90577e25d5537cb07290eca3fb8abff3bab316
Third Party Advisory third-party-advisory
https://www.vulncheck.com/advisories/hermes-webui-unauthenticated-passkey-registration-via-authentication-bypass
Scores
CVSS v3
9.1
EPSS
0.0058
EPSS Percentile
43.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Details
CWE
CWE-306
Status
published
Products (2)
hermes-webui/hermes-webui
< 0.51.409
hermes-webui/hermes-webui
0.51.409
Published
Jun 17, 2026
Tracked Since
Jun 18, 2026