CVE-2026-53871
Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that accepts unauthenticated profile names from the hermes_profile cookie. An authenticated attacker can forge the hermes_profile cookie value to bypass profile-scoped authorization checks and access sessions, files, and resources across different profiles.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.6
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.36%
- CWE
- CWE-565
- Published
- 2026-06-17
- Last modified
- 2026-07-14
Affected products
- nesquena hermes-webui
- nesquena hermes-webui
Weakness type
Related vulnerabilities
- CVE-2026-85181 — CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum
- CVE-2026-75757 — AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain
- CVE-2026-8337 — Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private surveys
- CVE-2026-0257 — PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
- CVE-2026-39963 — Serendipity: Host Header Injection enables authentication cookie scoping to an attacker-controlled domain
- CVE-2026-39324 — Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization
- CVE-2026-5130 — Debugger & Troubleshooter <= 1.3.2 - Unauthenticated Privilege Escalation to Administrator via Cookie Manipulation
- CVE-2014-125112 — Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution