SYS::ONLINE
Wasteland.
Briefs1674
Issues21
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-49973 2026-06-11

CVE-2026-49973: Unauthenticated Account Takeover in Hermes WebUI Setup

"A critical improper access control flaw lets unauthenticated remote attackers hijack the first-run setup of Hermes WebUI, seizing the admin password and locking out the legitimate operator."

A critical improper access control flaw lets unauthenticated remote attackers hijack the first-run setup of Hermes WebUI, seizing the admin password and locking out the legitimate operator.

What Is It

CVE-2026-49973 is an improper access control vulnerability (CWE-306, Missing Authentication for a Critical Function) in Hermes WebUI versions before 0.51.358. The settings API endpoint accepts a _set_password parameter during the first-run setup window without enforcing any network origin restriction. An unauthenticated attacker on any reachable network can send a POST request to that endpoint to persist an arbitrary password hash and obtain a valid session cookie.

Why It Matters

The flaw carries a CVSS 3.1 base score of 9.4 (CRITICAL), with a network attack vector, low complexity, and no privileges or user interaction required. A successful attacker gains a valid session and locks the legitimate operator out of their own instance; a full takeover of confidentiality and integrity. The secondary CVSS 4.0 score is 9.2 (CRITICAL). No KEV entry was supplied, so active exploitation is not confirmed in this source material.

What's Vulnerable

Hermes WebUI before version 0.51.358 is affected. Exploitation hinges on the initial setup window: an instance that has not yet completed first-run configuration is exposed, since the settings endpoint applies no origin restriction before a password is set. No specific affected CPE entries were provided in the NVD record.

Patch Status

The issue is fixed in Hermes WebUI v0.51.358. Operators should upgrade to that release or later. The fix is tracked in the project's commit and pull requests linked below; complete setup promptly and avoid exposing un-configured instances to untrusted networks.

Sources