CVE-2026-49973: Hermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settings

Synopsis

This is an improper access control vulnerability in Hermes WebUI versions before 0.51.358. The /api/settings endpoint accepts a _set_password parameter during the first-run setup window without any authentication or network-origin check, meaning any attacker who can reach the service over the network can send a single POST request to take over the instance. Successful exploitation lets the attacker set an arbitrary password hash, obtain a valid session cookie, and permanently lock out the legitimate operator. A patched-image rebuild at version 0.51.358 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Hermes WebUI service over the network; the vulnerable endpoint is exposed via HTTP with no network-origin restriction.

• AuthenticationNot required

  No credentials of any kind are required; the /api/settings endpoint accepts the _set_password parameter from completely unauthenticated requests.

• Victim interactionNot required

  The attacker sends a direct POST request to the target endpoint with no user action needed on the part of any legitimate user.

• Attack complexityDetail

  The attack itself is condition-free and reliably reproducible, though successful takeover depends on the target still being in its first-run setup window (the AT:P token in the vector reflects this situational prerequisite).

Blast Radius

• Attacker persists an arbitrary password hash to the Hermes WebUI instance, taking full administrative control of the application.
• Attacker receives a valid session cookie granting authenticated access to all settings, integrations, and data visible through the WebUI.
• The legitimate operator is locked out of their own instance and loses the ability to administer or recover the service without out-of-band intervention.
• Availability impact is low rather than total: the service itself keeps running, but under attacker control rather than operator control.