This vulnerability affects the resolve_session_by_title function in the hermes_state.py file of the resume Endpoint component in NousResearch hermes-agent up to version 0.12.0. By manipulating the Title argument, an attacker can bypass authorization controls remotely. The vulnerability has been publicly disclosed, but the vendor has not provided any response or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to bypass authorization controls remotely by manipulating the Title argument in the affected function. This could lead to unauthorized access to session data or functionality within the hermes-agent resume Endpoint. The impact is rated medium based on the CVSS score of 5.3. There is no indication of privilege escalation or denial of service from the provided data.

No official patch or remediation is currently available as the vendor has not responded to the disclosure. Users should monitor the vendor's communications for any future updates or fixes. Until a fix is released, consider restricting network access to the affected service to trusted users only and applying compensating controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.