Which versions of Hermes WebUI are affected by CVE-2026-55196?

Hermes WebUI deployments are vulnerable to administrative account compromise through an authentication bypass affecting versions prior to 0.51.409.. A patch is available.

How to fix or mitigate CVE-2026-55196?

Within 24 hours: Identify all Hermes WebUI instances in your environment and determine which have passkey authentication enabled (HERMES_WEBUI_PASSKEY=1) without pre-existing credentials. Within 7 days: Deploy vendor-released patch to Hermes WebUI version 0.51.409 or later across all affected systems, prioritizing production instances. Within 30 days: Complete patching of all remaining systems and review access logs for exploitation attempts.

Hermes WebUI CVE-2026-55196

Q: What is the CVSS score of CVE-2026-55196?

CVE-2026-55196 has a CVSS 4.0 base score of 9.1 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-17 VulnCheck

Authentication Bypass Hermes Webui

9.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.1 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.4 HIGH

Network reachable with no auth or UI, but AC:H reflects the first-credential race window and HERMES_WEBUI_PASSKEY=1 precondition; admin takeover gives C:H/I:H while service availability is unaffected.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 18:47 vuln.today

Analysis Generated

Jun 17, 2026 - 18:47 vuln.today

DescriptionCVE.org

Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication, allowing attackers to claim the first passkey and gain permanent administrative control.

AnalysisAI

Authentication bypass in Hermes WebUI before 0.51.409 allows unauthenticated remote attackers to register the first passkey on instances where HERMES_WEBUI_PASSKEY=1 is set and no credentials yet exist, yielding permanent administrative control. The flaw resides in the passkey registration API endpoints, which fail to enforce authentication during the initial enrollment window. No public exploit identified at time of analysis, but a vendor patch is available and the issue was disclosed by VulnCheck.

Technical ContextAI

Hermes WebUI is a web-based administration interface (Node.js/JavaScript project hosted at github.com/nesquena/hermes-webui) that supports WebAuthn passkeys as an authentication factor, gated by the HERMES_WEBUI_PASSKEY=1 environment flag. The vulnerable code paths are POST /api/auth/passkey/register/options (which returns a WebAuthn registration challenge) and POST /api/auth/passkey/register (which finalizes credential enrollment). The root cause is CWE-306 (Missing Authentication for a Critical Function): both endpoints lacked any session or first-run protection, so any HTTP client that reached the instance before an administrator enrolled could complete a full WebAuthn ceremony and become the registered credential holder. CPE coverage (cpe:2.3:a:hermes-webui:hermes-webui:*) confirms all versions prior to the fix branch are in scope.

RemediationAI

Vendor-released patch: upgrade to Hermes WebUI v0.51.442 or later, which requires authentication for passkey enrollment (see https://github.com/nesquena/hermes-webui/releases/tag/v0.51.442 and commit 4d90577e25d5537cb07290eca3fb8abff3bab316). If immediate patching is not possible, set HERMES_WEBUI_PASSKEY=0 to disable passkey registration entirely (trade-off: users lose WebAuthn as an authentication option and must rely on password or other configured factors), or enroll a known administrator passkey out-of-band before exposing the instance to any untrusted network so the first-credential window is closed. As an additional compensating control, restrict network reachability of /api/auth/passkey/register/options and /api/auth/passkey/register at a reverse proxy or firewall to trusted management IPs until the upgrade is applied (trade-off: legitimate remote enrollment is blocked from non-allowlisted networks).