NousResearch Hermes SimpleX Gateway Auth Bypass via Display Name Spoofing

Vulnerability Overview Title: Hermes SimpleX gateway allowlist authorization bypass via colliding contact display name #44730 Description: A vulnerability exists in the gateway authorization logic of Hermes SimpleX, allowing unauthorized SimpleX contacts to bypass authorization checks by setting their display name identical to that of an authorized contact. This grants them unauthorized access to the gateway and downstream agent/tool functionalities. Scope of Impact Affected Products: - Ecosystem: git - Package Name: NousResearch/hermes-agent - Affected Versions: Unreleased upstream main branch, starting from commit (released after v2026.6.5) - Patched Versions: Not yet released Severity: High Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Weakness: CWE-290: Authentication Bypass by Spoofing Remediation Current Status: The vulnerability has not yet been patched and persists in the unreleased main branch. Recommendation: Wait for the official release of a patched version or manually apply the patch. POC Code Detailed Information Vulnerability Path: Root Cause: Mixing of trust boundaries between stable identifiers and mutable profile metadata. Exploitation Conditions: An attacker can send messages to the deployed Hermes SimpleX gateway and select a display name identical to that of an authorized contact, thereby gaining unauthorized access. Conclusion This vulnerability allows unauthorized SimpleX contacts to bypass gateway authorization checks by setting a display name identical to that of an authorized contact, resulting in unauthorized access. It is recommended to wait for the official release of a patched version or manually apply the patch.

Goal Reached Thanks to every supporter — we hit 100%!

NousResearch Hermes SimpleX Gateway Auth Bypass via Display Name Spoofing

More from this source