Hermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settings
CVE-2026-49973

9.2CRITICAL

Key Information:

Vendor

Nesquena

Status
Hermes-webui
Vendor
CVE Published:
11 June 2026

What is CVE-2026-49973?

Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated remote attackers to hijack initial setup by submitting the _set_password parameter to the settings API endpoint without any network origin restriction. Attackers on any reachable network can send a POST request to the settings endpoint during the first-run setup window to persist an arbitrary password hash, obtain a valid session cookie, and lock out the legitimate operator from their own instance.

Affected Version(s)

hermes-webui 0

References

https://github.com/nesquena/hermes-webui/releases/tag/v0....
release-notes
https://github.com/nesquena/hermes-webui/pull/3964
issue-tracking
https://github.com/nesquena/hermes-webui/pull/3973
issue-tracking

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chia Min Jun Lennon
.