CVE-2026-53871
Hermes WebUI < 0.51.368 - Profile-Scoped Authorization Bypass via Forged hermes_profile Cookie
CVSS 4.0 8.6 HIGHCVSS 3.1 8.1 HIGHCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-53871
PublishedHermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that accepts unauthenticated profile names from the hermes_profile cookie. An authenticated attacker can forge the hermes_profile cookie value to bypass profile-scoped authorization checks and access sessions, files, and resources across different profiles.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-53871 · CVE overview and exploitation status
cve-program · CVE-2026-53871
- https://github.com/nesquena/hermes-webui/releases/tag/v0.51.368
- https://github.com/nesquena/hermes-webui/pull/4023
- https://github.com/nesquena/hermes-webui/pull/4036
- https://github.com/nesquena/hermes-webui/commit/9e96f5f6adf93b6d1e27ebddfb4d2833ca06ff3b
- https://www.vulncheck.com/advisories/hermes-webui-profile-scoped-authorization-bypass-via-forged-hermes-profile-cookie
Related changes
Linked by CVE identifierNo related changes are available here.