CVE-2026-53871: Nesquena Hermes-Webui

High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days.

Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that accepts unauthenticated profile names from the hermes_profile cookie. An authenticated attacker can forge the hermes_profile cookie value to bypass profile-scoped authorization checks and access sessions, files, and resources across different profiles.

Affected products

• Nesquena Hermes-Webui: before 0.51.368 (fixed in 0.51.368)

Published 2026-06-17. Last modified 2026-09-17.