PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-55196 nesquena CVE debrief

A critical vulnerability, CVE-2026-55196, has been discovered in Hermes WebUI, a web-based user interface for Hermes. The vulnerability is an authentication bypass issue that allows unauthenticated remote attackers to register arbitrary passkeys. When the HERMES_WEBUI_PASSKEY=1 configuration is enabled with no existing credentials, the POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication. This allows attackers to claim the first passkey and gain permanent administrative control. The vulnerability has a CVSS score of 9.1 and is considered critical.

Vendor
nesquena
Product
hermes-webui
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-23
Advisory published
2026-06-17
Advisory updated
2026-06-23

Who should care

Administrators and users of Hermes WebUI, especially those who have enabled the HERMES_WEBUI_PASSKEY=1 configuration, should be aware of this vulnerability and take immediate action to mitigate it. This vulnerability can allow attackers to gain permanent administrative control, potentially leading to unauthorized access and malicious activities.

Technical summary

The vulnerability exists in the passkey registration endpoints of Hermes WebUI. Specifically, when HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, the POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication. This allows attackers to register arbitrary passkeys and gain permanent administrative control. The vulnerability is caused by a lack of proper authentication checks in the affected endpoints.

Defensive priority

High

Recommended defensive actions

  • Update Hermes WebUI to version 0.51.442 or later
  • Disable the HERMES_WEBUI_PASSKEY=1 configuration if not required
  • Implement proper authentication checks for passkey registration endpoints
  • Monitor for suspicious activity on the affected endpoints
  • Restrict access to the affected endpoints to authenticated users only
  • Consider using alternative authentication methods, such as multi-factor authentication

Evidence notes

The vulnerability was reported by Vulncheck and is publicly disclosed. The CVE record and NVD detail pages provide additional information about the vulnerability. GitHub commits and pull requests are available for reference.

Official resources

public