Hermes Webui

Authentication bypass in Hermes WebUI before 0.51.307 lets unauthenticated remote attackers reach onboarding endpoints that are supposed to be restricted to loopback traffic by spoofing an X-Forwarded-For header with a 127.0.0.1 value. Once past the origin check, an attacker can pivot to server-side request forgery against internal services and cloud metadata endpoints, overwrite LLM provider configuration and API keys, or start an OAuth device-code flow to mint persistent tokens saved in auth.json. A vendor patch exists; the flaw carries a CVSS 4.0 score of 9.3, but no public exploit code has been identified at time of analysis.

Unauthenticated remote code execution in Hermes WebUI before version 0.51.788 lets remote attackers run arbitrary shell commands by reaching the product's embedded terminal API without any credentials. Because of a missing authentication check (CWE-306), an attacker chains four sequential unauthenticated HTTP requests to create a session, attach a PTY shell, and inject commands, executing code as the server process user. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; a vendor patch is available and no public exploit code has been identified at time of analysis.

Cross-profile workspace isolation bypass in Hermes WebUI before 0.51.521 allows an authenticated low-privilege user operating under the default profile to read files scoped to other named profiles' workspaces. The /api/session/import handler validates the workspace against the active named profile but omits setting the profile field on the constructed Session object, persisting it with a null profile value. Because the authorization layer treats null profile as equivalent to the default profile, any default-profile user can exploit imported session identifiers to traverse the intended profile boundary and extract file contents - a complete defeat of the application's workspace isolation model. No public exploit is identified at time of analysis, and a vendor-released patch is available at v0.51.521.

Resource exhaustion in Hermes WebUI before 0.51.468 exposes an unauthenticated POST /api/onboarding/oauth/start endpoint that accumulates unbounded in-memory OAuth flow state and daemon polling threads with each incoming request, enabling remote denial of service without authentication. The root cause - confirmed by vendor release notes and fix commit ce272d9 - is the absence of any deduplication or serialization check before allocating a new flow entry and spawning a worker thread per request. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Cross-profile session data exfiltration in Hermes WebUI before 0.51.443 lets any authenticated user retrieve session transcripts belonging to other profiles by calling the session export endpoint with a guessed or known session ID. The flaw is a classic IDOR (CWE-639) in the _handle_session_export handler, which omits active-profile ownership checks before serializing the requested session. No public exploit identified at time of analysis, but VulnCheck published a coordinated advisory and the upstream fix is shipped in v0.51.443.

Cross-profile session disclosure in Hermes WebUI before 0.51.443 lets any authenticated user retrieve conversation transcripts and metadata belonging to other profiles by passing a foreign session_id to the /api/session endpoint. The flaw is a classic IDOR (CWE-639) where profile boundary checks are missing on by-id reads. No public exploit identified at time of analysis, but the trigger is a single trivial GET request and the upstream patch openly describes the fix as 'scope session by-id reads + exports to active profile,' which discloses the bypass.

Authentication bypass in Hermes WebUI before 0.51.409 allows unauthenticated remote attackers to register the first passkey on instances where HERMES_WEBUI_PASSKEY=1 is set and no credentials yet exist, yielding permanent administrative control. The flaw resides in the passkey registration API endpoints, which fail to enforce authentication during the initial enrollment window. No public exploit identified at time of analysis, but a vendor patch is available and the issue was disclosed by VulnCheck.

Cross-profile authorization bypass in Hermes WebUI before 0.51.368 allows authenticated users to access sessions, files, and resources belonging to other profiles by forging the hermes_profile cookie. The flaw lives in get_profile_cookie(), which trusted attacker-supplied profile names without binding them to the authenticated session. VulnCheck reported the issue and an upstream patch is available; no public exploit identified at time of analysis.

Unauthenticated initial-setup hijack in Hermes WebUI before 0.51.358 allows any remote attacker who can reach the settings API endpoint during the first-run window to POST the _set_password parameter, persist an arbitrary password hash, and obtain a valid administrative session cookie. The flaw, reported by VulnCheck and tracked as an improper access control (CWE-306) issue, locks the legitimate operator out of their own instance and grants full administrative control. No public exploit identified at time of analysis, but an upstream fix landed in release v0.51.358.

Cross-profile data disclosure in Hermes WebUI before 0.51.269 allows authenticated users to read session titles and transcript message content from other users' profiles by querying the sessions search endpoint, which fails to scope results to the caller's active profile. The flaw was reported by VulnCheck and a vendor patch is available; no public exploit identified at time of analysis, but the issue is trivial to trigger for any logged-in account.

Resource exhaustion in Hermes WebUI before v0.51.270 allows unauthenticated remote attackers to degrade service availability by abusing the WebAuthn passkey options endpoint without rate limiting or challenge lifecycle enforcement. Repeated POST requests to the authentication endpoint cause the server-side challenge store file to grow without bound, generating sustained CPU load and disk I/O pressure through continuous JSON file rewrites. No public exploit identified at time of analysis and not listed in CISA KEV; EPSS data was not available in provided intelligence. The fix is confirmed in the vendor-released v0.51.270.

Information disclosure in Hermes WebUI before v0.51.221 allows authenticated remote attackers to read arbitrary files outside the designated workspace by placing symlinks that resolve to external host paths and accessing them through the workspace file or listing APIs. Because the vulnerable code only blocked raw '..' traversal and a small denylist of system directories rather than enforcing that resolved targets stay within the workspace root, attackers can disclose sensitive host content such as SSH keys, cloud credentials, and application tokens. No public exploit identified at time of analysis, but the patch and a VulnCheck advisory are published and the fix is straightforward to reverse-engineer from the upstream commit.

Path traversal in Hermes WebUI's session import endpoint allows authenticated low-privileged attackers to read arbitrary files accessible to the WebUI process. By importing a crafted session JSON with an unrestricted workspace value such as '/', an attacker bypasses the workspace boundary controls that govern every other workspace-bearing endpoint, then leverages the file API to exfiltrate any file readable by the WebUI process user. No active exploitation is confirmed (absent from CISA KEV), EPSS sits at 0.04% in the 12th percentile, and SSVC rates exploitation as none - but the CVSS 4.0 confidentiality impact is rated High, making this a meaningful risk for network-exposed deployments with authenticated user populations.

Arbitrary file deletion in Hermes WebUI (nesquena/hermes-webui, all versions prior to the PR #409 fix) allows an authenticated attacker to delete arbitrary writable JSON files on the host by supplying an absolute path or path-traversal sequence in the session_id parameter of the /api/session/delete endpoint. Because the endpoint concatenates the unvalidated identifier onto SESSION_DIR without canonicalization, an attacker can escape the intended session directory and destroy files outside it. Publicly available exploit code exists (VulnCheck advisory and upstream regression tests demonstrate the payloads), but it is not listed in CISA KEV and EPSS is low (0.09%, 26th percentile), indicating no evidence of widespread automated exploitation.

Environment variable leakage in nesquena/hermes-webui exposes provider API keys and other profile-scoped secrets across profile boundaries when users switch active profiles. The `_reload_dotenv` function in `api/profiles.py` loaded each new profile's `.env` additively into `os.environ` without first purging variables set by the previously active profile, meaning credentials such as `OPENAI_API_KEY` persisted beyond their intended security scope. No active exploitation has been observed (SSVC: Exploitation=none, EPSS 0.01% / 2nd percentile), but the flaw is a clear, reproducible confidentiality break confirmed by vendor source code diff and a VulnCheck advisory.

Path traversal in nesquena hermes-webui allows any authenticated user to redirect a session workspace to an arbitrary existing directory on the host filesystem by supplying attacker-controlled paths to four POST endpoints. Once the workspace is redirected, the attacker leverages the application's own file read and write APIs to access or modify files well outside the intended workspace sandbox, bounded only by the OS-level permissions of the hermes-webui process. No public exploit is identified at time of analysis and this is not listed in CISA KEV; vendor-patched release v0.50.34 is available.