CVE-2026-55196: Hermes WebUI < 0.51.409 - Unauthenticated Passkey Registration via Authentication Bypass
Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMESWEBUIPASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication, allowing attackers to claim the first passkey and gain permanent administrative control.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hermes WebUIto a version that resolves this vulnerability.Fixed in 0.51.409 - Configuration
Set HERMES_WEBUI_PASSKEY=0 to prevent unauthenticated passkey registration when no existing credentials are present.
Hermes WebUI HERMES_WEBUI_PASSKEY = 0 - Compensating control
If passkey functionality must be enabled, ensure the passkey registration endpoints (/api/auth/passkey/register/options and /api/auth/passkey/register) are not reachable without authentication (e.g., restrict network access / enforce an authentication layer before these endpoints).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55196?
CVE-2026-55196 has a critical severity rating of 9.1.
How do I fix CVE-2026-55196?
To fix CVE-2026-55196, upgrade Hermes WebUI to version 0.51.409 or later.
What does CVE-2026-55196 affect?
CVE-2026-55196 affects Hermes WebUI versions prior to 0.51.409.
What type of vulnerability is CVE-2026-55196?
CVE-2026-55196 is an authentication bypass vulnerability.
Who is impacted by CVE-2026-55196?
Unauthenticated remote attackers can exploit CVE-2026-55196 to register arbitrary passkeys.