Executive Summary

Hermes WebUI versions before 0.51.409 have an authentication bypass vulnerability in the passkey registration endpoints. Specifically, when the environment variable HERMES_WEBUI_PASSKEY is set to 1 and there are no existing credentials, the endpoints POST /api/auth/passkey/register/options and POST /api/auth/passkey/register can be accessed without authentication.

This allows unauthenticated remote attackers to register arbitrary passkeys, effectively letting them claim the first passkey and gain permanent administrative control over the system.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a severe impact as it allows attackers to bypass authentication and gain permanent administrative control over the Hermes WebUI system.

With administrative control, attackers can manipulate system settings, access sensitive data, and potentially compromise the entire environment where Hermes WebUI is deployed.

Useful 0 Not Useful 0