CVE-2026-53871 Details
Description
Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that accepts unauthenticated profile names from the hermes_profile cookie. An authenticated attacker can forge the hermes_profile cookie value to bypass profile-scoped authorization checks and access sessions, files, and resources across different profiles.
An authorization bypass vulnerability has been identified in Hermes WebUI versions prior to 0.51.368. The issue resides in the 'get_profile_cookie()' function, which accepts unauthenticated profile names from the 'hermes_profile' cookie. This vulnerability allows an authenticated attacker to forge the 'hermes_profile' cookie value, bypassing profile-specific authorization checks and gaining access to sessions, files, and resources across different profiles.
Users should update to Hermes WebUI version 0.51.368 or later, where this vulnerability has been addressed by binding the active-profile cookie to the authentication session, preventing unauthorized profile impersonation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 17, 2026CISA-ADP
Assessed Jun 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nesquena/hermes-webui/commit/9e96f5f6adf93b6d1e27ebddfb4d2833ca06ff3b | [email protected] | Source CodeVendor |
| https://github.com/nesquena/hermes-webui/pull/4023 | [email protected] | Issue TrackingVendor |
| https://github.com/nesquena/hermes-webui/pull/4036 | [email protected] | Issue TrackingVendor |
| https://github.com/nesquena/hermes-webui/releases/tag/v0.51.368 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/hermes-webui-profile-scoped-authorization-bypass-via-forged-hermes-profile-cookie | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-565 | Reliance on Cookies without Validation and Integrity Checking | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Hermes WebUI | < 0.51.368 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | [email protected] |
| Jun 18, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | [email protected] |