What’s Vulnerable › Vulnerabilities

CVE-2026-55196: Hermes WebUI < 0.51.409 - Unauthenticated Passkey Registration via Authentication Bypass

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-17 · updated 2026-09-17
• Weakness: CWE-306

Description

Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication, allowing attackers to claim the first passkey and gain permanent administrative control.

Affected products

• hermes-webui: before 0.51.409 — fixed in 0.51.409

How to fix

Upgrade to a fixed version: hermes-webui 0.51.409. Check the vendor advisory for mitigations.

References

• https://github.com/nesquena/hermes-webui/commit/4d90577e25d5537cb07290eca3fb8abff3bab316
• https://github.com/nesquena/hermes-webui/pull/4171
• https://github.com/nesquena/hermes-webui/pull/4267
• https://github.com/nesquena/hermes-webui/releases/tag/v0.51.442
• https://www.vulncheck.com/advisories/hermes-webui-unauthenticated-passkey-registration-via-authentication-bypass

Get alerted when CVE-2026-55196 or the next vulnerability affects your stack