THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-53871 (HIGH 8.1) — Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that accepts unauthenticated profile names from the hermes_profile cookie. An authenticated attacker can forge the hermes_profile cookie value to bypass profile-scoped

[NVD] CVE-2026-53871 (HIGH 8.1) — Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that accepts unauthenticated profile names from the hermes_profile cookie. An authenticated attacker can forge the hermes_profile cookie value to bypass profile-scoped

lownvdPublished 2026-06-17

CVE-2026-53871 CVSS: 8.1 HIGH Published: 2026-06-17T19:18:11.023

Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that accepts unauthenticated profile names from the hermes_profile cookie. An authenticated attacker can forge the hermes_profile cookie value to bypass profile-scoped authorization checks and access sessions, files, and

Indicators of compromise

CVE-2026-53871cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-53871