CVE-2026-55196CWE-306

CVE-2026-55196

Critical · published June 17, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
56.7
In the wild
Unconfirmed
What it is

Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication, allowing attackers to claim the first passkey and gain permanent administrative control.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00817 · 56.7th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-06-17T23:18Z
References (5)
https://github.com/nesquena/hermes-webui/commit/4d90577e25d5537cb07290eca3fb8abff3bab316 · [email protected]https://github.com/nesquena/hermes-webui/pull/4171 · [email protected]https://github.com/nesquena/hermes-webui/pull/4267 · [email protected]https://github.com/nesquena/hermes-webui/releases/tag/v0.51.442 · [email protected]https://www.vulncheck.com/advisories/hermes-webui-unauthenticated-passkey-registration-via-authentication-bypass · [email protected]
EPSS history
Timeline
  • 17 JUN 17:58Z
    Hermes WebUI < 0.51.409 - Unauthenticated Passkey Registration via Authentication Bypass
    cvelistv5