CVE-2026-55196: Hermes WebUI < 0.51.409 - Unauthenticated Passkey Registration via Authentication Bypass

Synopsis

An authentication bypass vulnerability in Hermes WebUI before 0.51.409 allows an unauthenticated remote attacker to register arbitrary passkeys via exposed passkey registration endpoints. The flaw is reachable over the network with no credentials required, and only triggers when HERMES_WEBUI_PASSKEY=1 is set and no passkey has yet been registered. Successful exploitation lets an attacker claim the first passkey and gain permanent administrative control over the application. A patched-image rebuild at version 0.51.409 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Hermes WebUI service over the network; the vulnerable endpoints are exposed via HTTP without any network-layer restriction by default.

• AuthenticationNot required

  No credentials of any kind are needed; the passkey registration endpoints accept unauthenticated POST requests when the passkey feature is enabled and no passkey has been registered yet.

• Victim interactionNot required

  The attack is fully automated and requires no action from any user or administrator of the target application.

• Attack complexityDetail

  Exploitation is straightforward but depends on an environmental precondition: the HERMES_WEBUI_PASSKEY=1 flag must be set and the passkey store must be empty, which maps to the AT:P (attack requirements present) token in the vector.

Blast Radius

• Attacker registers the first passkey and claims permanent administrative access to the Hermes WebUI instance.
• All configuration, secrets, and data managed through the WebUI become readable by the attacker using the registered passkey.
• The attacker can modify application settings, add or remove users, and alter any data persisted through the admin interface.
• Existing legitimate administrators may be locked out if the attacker reconfigures authentication settings after gaining control.