Is CVE-2026-55196 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55196 being exploited in the wild.

How severe is CVE-2026-55196?

Critical severity, with a CVSS score of 9.1, published 17 June 2026.

Which products and versions are affected?

nesquena Hermes WebUI before 0.51.409.

Is there a fix for CVE-2026-55196?

A patch was published on 2026-06-15: Fix merged and released in version 0.51.442 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55196 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55196?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55196: Hermes WebUI authentication bypass in passkey registration

CVE-2026-55196 · Severity: critical · CVSS 9.1 · Published 2026-06-17

Hermes WebUI, a web-based management interface, contains a security flaw in how it handles initial setup when passkeys are enabled. If the software is deployed to a publicly accessible server before the owner completes the initial configuration, an unauthorized person can register their own passkey first. This allows an attacker to claim administrative ownership of the system, potentially leading to full control over the application and its data.

Quick answers

Is CVE-2026-55196 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55196 being exploited in the wild.
How severe is CVE-2026-55196?: Critical severity, with a CVSS score of 9.1, published 17 June 2026.
Which products and versions are affected?: nesquena Hermes WebUI before 0.51.409.
Is there a fix for CVE-2026-55196?: A patch was published on 2026-06-15: Fix merged and released in version 0.51.442 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55196 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55196?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authentication check (CWE-306) exists in the passkey registration endpoints of Hermes WebUI. When the environment variable HERMES_WEBUI_PASSKEY=1 is enabled and no credentials have been previously established, the POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication. An unauthenticated remote attacker can exploit this window of opportunity during the 'first-run' state to register the initial passkey, effectively bootstrapping themselves as the administrator. The fix, introduced in version 0.51.409 (and refined in 0.51.442), implements an onboarding gate that restricts initial registration to loopback or private network requests unless explicitly overridden by the operator.

Affected products

nesquena Hermes WebUI before 0.51.409

Timeline

2026-06-14: other: Initial fix proposed in pull request #4171
2026-06-15: patched: Fix merged and released in version 0.51.442
2026-06-17: disclosed: CVE-2026-55196 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.