The vulnerability arises from manipulating the _INSECURE_NO_AUTH argument in gateway/platforms/webhook.py, allowing requests to the Webhooks Endpoint to bypass authentication. The description states that attacks can be launched remotely with a high level of complexity and that exploitation is difficult. While the impact on confidentiality, integrity, or availability is not explicitly detailed, it indicates that the unauthenticated endpoint could enable unintended use of the component. Based on the description, it is inferred that this may allow attackers to trigger arbitrary actions or retrieve sensitive data.

The issue affects NousResearch hermes‑agent version 0.8.0, specifically the Webhooks Endpoint component located in the gateway/platforms/webhook.py module. No other versions have been identified as vulnerable at this time.

Based on the CVE description, the flaw can be exploited remotely by sending requests with the _INSECURE_NO_AUTH parameter. The description states that the exploit requires a high level of complexity and is publicly documented but difficult to execute. The CVSS score of 6.3 indicates medium‑to‑high impact, and the EPSS score of less than 1% suggests a low current exploitation probability. The flaw is not listed in the CISA KEV catalog. While the description does not detail the exact damage that could be caused, it is inferred that unauthenticated access could allow the Webhooks Endpoint to be used to perform actions within the hermes‑agent system.