Description
Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication, allowing attackers to claim the first passkey and gain permanent administrative control.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| hermes-webui | hermes-webui | < 0.51.409 | 0.51.409 |
References
- hermes-webui v0.51.442 Release Notes release-notes
- Researcher Pull Request issue-tracking patch
- Maintainer Pull Request issue-tracking patch
- Patch Commit patch
- https://www.vulncheck.com/advisories/hermes-webui-unauthenticated-passkey-registration-via-authentication-bypass third-party-advisory