CVE-2026-49973 describes an improper access control vulnerability in nesquena's Hermes WebUI before version 0.51.358. The flaw allows unauthenticated remote attackers to hijack the initial setup by sending a POST request with the _set_password parameter to the settings API endpoint without any network origin restrictions. This enables attackers on any reachable network to persist an arbitrary password hash, gain a valid session cookie, and effectively lock out the legitimate operator from their instance. The vulnerability is present only during the first-run setup window and does not require prior authentication.

An attacker can remotely hijack the initial setup process of Hermes WebUI, set an arbitrary password, obtain a valid session cookie, and lock out legitimate users from accessing their own instance. This compromises the confidentiality and integrity of the system's authentication mechanism, potentially leading to full administrative control by unauthorized parties.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device during initial setup to trusted networks only to prevent unauthorized POST requests to the settings API endpoint. Monitor vendor communications for updates regarding an official patch or workaround.