VULNERABILITY INTELLIGENCE
CVE-2026-55196
CVSS score9.1 CRITICAL
EPSS probability0.58%
CISA KEVNot currently listed
Published2026-06-17
Last modified2026-09-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication, allowing attackers to claim the first passkey and gain permanent administrative control.
Weakness classification
- disclosure@vulncheck.com: CWE-306