CVE-2026-49973: Hermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settings
Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated remote attackers to hijack initial setup by submitting the setpassword parameter to the settings API endpoint without any network origin restriction. Attackers on any reachable network can send a POST request to the settings endpoint during the first-run setup window to persist an arbitrary password hash, obtain a valid session cookie, and lock out the legitimate operator from their own instance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hermes WebUIto a version that resolves this vulnerability.Fixed in 0.51.358 - Compensating control
Restrict network access to the Hermes WebUI settings endpoint (e.g., /api/settings) so it is not reachable from any untrusted/external networks during the first-run setup window.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49973?
CVE-2026-49973 has a critical severity rating of 9.2.
How do I fix CVE-2026-49973?
To fix CVE-2026-49973, upgrade Hermes WebUI to version 0.51.358 or later.
What vulnerabilities does CVE-2026-49973 exploit?
CVE-2026-49973 exploits an improper access control vulnerability allowing unauthenticated password takeover.
Can CVE-2026-49973 be exploited remotely?
Yes, CVE-2026-49973 can be exploited remotely by unauthenticated attackers.
What are the consequences of CVE-2026-49973 exploitation?
Exploitation of CVE-2026-49973 can lead to unauthorized access and control over the initial setup of the Hermes WebUI.