CyberRota Analysis
AI-GeneratedHermes WebUI versions prior to 0.51.307 are vulnerable to an authentication bypass that enables unauthenticated remote attackers to bypass local-origin IP restrictions by manipulating the X-Forwarded-For header. This vulnerability can lead to severe impacts, including server-side request forgery against internal services, unauthorized modification of configuration settings, and the potential to gain persistent access tokens. Organizations using affected versions should prioritize immediate remediation to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restrictions on onboarding endpoints by supplying a spoofed X-Forwarded-For header with a loopback address. Attackers can exploit this bypass to perform server-side request forgery against internal services including cloud metadata endpoints, overwrite LLM provider configuration and API keys with attacker-controlled values, or initiate OAuth device-code flows to obtain persistent access tokens stored in auth.json.