Vulnerability · Published Jun 17, 2026 · Assigned by VulnCheck

CVE-2026-55196Hermes WebUI < 0.51.409 - Unauthenticated Passkey Registration via Authentication Bypass

Critical 9.1

In plain English

A critical-severity missing authentication in hermes-webui from hermes-webui. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.6%top 52.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication, allowing attackers to claim the first passkey and gain permanent administrative control.

Affected products (as reported)

Vendor	Product	Versions
hermes-webui	hermes-webui	0 – before 0.51.409

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

hermes-webui v0.51.442 Release Notes release-notes
Researcher Pull Request issue-tracking, patch
Maintainer Pull Request issue-tracking, patch
Patch Commit patch
https://www.vulncheck.com/advisories/hermes-webui-unauthenticated-passkey-registration-via-authentication-bypass third-party-advisory