This vulnerability affects the hermes-agent software by NousResearch, specifically versions 0.1 through 0.12.0. The flaw is in the resolve_session_by_title function of the hermes_state.py file, where improper handling of the Title argument leads to an authorization bypass. This allows an attacker with network access and low privileges to remotely bypass authorization checks without user interaction. The vulnerability has been publicly disclosed, but no official remediation or patch has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability enables an attacker to bypass authorization mechanisms remotely, potentially gaining unauthorized access to session data or functionality protected by the resume Endpoint. The CVSS score of 5.3 reflects a medium impact, with low attack complexity and no user interaction required. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. Until a patch is available, consider restricting network access to the affected service and applying compensating controls to limit exposure.