The vulnerability originates from the _check_auth function in gateway/platforms/api_server.py of the API_SERVER_KEY Handler. An attacker can manipulate requests to bypass authentication checks, allowing unauthorized access to the API. Because the flaw permits remote exploitation and can lead to full control over the system, it presents an authentication bypass (CWE‑287) that threatens confidentiality, integrity, and availability.

The affected product is NousResearch's hermes‑agent, version 0.8.0. Only this release is identified; no other versions or variants are listed. The vulnerability specifically targets the API_SERVER_KEY component exposed within the agent's gateway module.

The CVSS score of 6.3 marks the issue as moderate severity, and the EPSS value of < 1 % indicates a low likelihood of exploitation at present. The issue has not yet been recorded in the CISA KEV catalog, suggesting no publicly known exploitation campaigns. Attackers would need to initiate the exploit remotely against the API, a task characterized as high complexity and difficult, so the overall risk is moderate but should be considered in environments where the agent services sensitive data.