Threats tagged 'brew-hermes-agent-cve-2026-48524'

CVE-2026-48524 is a denial-of-service vulnerability in Hermes agent's PyJWKClient component. The flaw causes the client to issue a fresh HTTP request to the JWKS endpoint for every JWT with an unknown key ID (kid) without rate limiting. This can be exploited by an attacker sending tokens with attacker-controlled kid values, triggering unlimited outbound requests and causing network latency and potential cascading failures in authentication. The vulnerability affects versions from 2026.4.30 up to but not including 2026.7.1. A fix is available in version 2026.7.1.