CVE-2026-55196 — Hermes WebUI < 0.51.409 - Unauthenticated Passkey Registration via Authentication Bypass
Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary…
Published: 2026-06-17 · CVSS: 9.1 · CVSS 4.0
Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication, allowing attackers to claim the first passkey and gain permanent administrative control.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7