THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-55196 (CRITICAL 9.1) — Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/

[NVD] CVE-2026-55196 (CRITICAL 9.1) — Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/

lownvdPublished 2026-06-17

CVE-2026-55196 CVSS: 9.1 CRITICAL Published: 2026-06-17T19:18:13.203

Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/regist

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-55196cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-55196