This vulnerability affects the hermes-agent 0.8.0 from NousResearch, specifically in the webhook.py file within the Webhooks Endpoint component. By manipulating the _INSECURE_NO_AUTH argument, an attacker can bypass authentication mechanisms, resulting in missing authentication controls. The attack can be performed remotely but requires high complexity, and no privileges or user interaction are needed. The vulnerability has been publicly disclosed, but no official fix or patch has been released by the vendor as of the publication date.

Successful exploitation allows an attacker to bypass authentication on the affected webhook endpoint, potentially enabling unauthorized access to functionality that should be protected. The impact is limited by the high complexity required to exploit the vulnerability and the low vector and impact metrics in the CVSS vector. No known exploits are currently observed in the wild.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded or released a fix, users should monitor the vendor advisory for updates. Until a fix is provided, consider restricting network access to the webhook endpoint or implementing external authentication controls to mitigate unauthorized access risks.