https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T08:19:09.293336+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-371467 EUVD-2026-371467 2026-10-10T08:19:09.311995+00:00 EUVD-2026-371467 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55196 fkie_cve-2026-55196 2026-10-10T08:19:09.312031+00:00

Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication, allowing attackers to claim the first passkey and gain permanent administrative control.

 https://cve.radiocsirt.org/vuln/ghsa-5j37-rf54-82q2 GHSA-5j37-rf54-82q2 2026-10-10T08:19:09.312067+00:00

Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication, allowing attackers to claim the first passkey and gain permanent administrative control.