CVE-2026-49973

Name of the Vulnerable Software and Affected Versions Hermes WebUI versions prior to 0.51.358

Description Improper access control allows unauthenticated remote attackers to hijack the initial setup process. By sending a POST request to the settings API endpoint without network origin restrictions, an attacker can submit the set password parameter to persist an arbitrary password hash. This action enables the attacker to obtain a valid session cookie and lock the legitimate operator out of the instance.

Recommendations Update to version 0.51.358 or later. Isolate affected systems immediately to prevent unauthorized access.