DIGGINGBEAGLE

Case · DiggingBeagle record

Hermes Agent PKCE callback trusted a loopback host the browser did not use

Tenable disclosed a Hermes Agent dashboard authentication vulnerability: server-side URL parsing accepted a loopback callback that the browser could interpret as an attacker-controlled destination. With an attacker-chosen PKCE challenge, the redirected authorization code could enable a full victim session takeover. Versions before 0.21.6 are affected.

Agent authority

Assessment profile

Assessment method
Setting
research demonstration
Exploitation
demonstrated
Evidence
Grade B
Remediation
patch available
AI role
AGAINST AI
Basis and provenance

Tenable demonstrated the redirect mismatch and authorization-code leakage in a controlled browser test. The victim session exchange was described as feasible, not independently shown as live account compromise. Maintainer code and regression evidence support a patch available in v0.21.6; Desktop/Termux bundle rollout and in-the-wild exploitation remain unverified. No measured victim impact band is defensible.

Assessed Oct 11, 2026 using diggingbeagle.assessment/1.

Evidence basis: CLM-HERMES-PKCE-PARSER · CLM-HERMES-PKCE-TAKEOVER · CLM-HERMES-PKCE-CANONICAL-FIX · Tenable TRA-2026-65: Hermes Agent PKCE Session Takeover via Redirect-URI Parser Confusion · Hermes Agent pull request 130685: canonical native sign-in callback · NousResearch Hermes Agent v0.21.6 release and security fixes

At a glance

Mechanism and trust boundary

  1. 01

    Supply a redirect URI accepted by the server

    The authorization route checks the hostname with a Python parser but retains the original unnormalized string.

    Boundary: client-controlled callback / server validation

  2. 02

    Browser resolves a different destination

    Browser URL interpretation disagrees about a backslash and can navigate to an unintended host.

    Boundary: server validation / browser navigation

  3. 03

    Callback code is delivered outside the intended loopback destination

    The callback can carry the authorization code and state to a party controlling the selected PKCE challenge.

    Boundary: authorization code / session token exchange

Timeline

  1. Sep 3, 2026
    Event type unspecified

    Researcher starts coordinated disclosure

    Tenable lists initial contact with the maintainer.

  2. Sep 3, 2026
    notification

    Vendor notified

  3. Oct 1, 2026
    patch

    Fix date recorded

  4. Oct 5, 2026
    Event type unspecified

    Maintainer reports repair

    Tenable records a fix reported by Nous Research and identifies 0.21.6 as the corrected release.

  5. Oct 9, 2026
    Event type unspecified

    Tenable issues TRA-2026-65

    High-severity redirect-URI and PKCE session-takeover mechanism is publicly described.

  6. Oct 9, 2026
    disclosure

    Public disclosure

Claims & evidence

CLM-HERMES-PKCE-DATETenable first contacted the maintainer on September 3, 2026, recorded a fix discussion on October 5, and first published TRA-2026-65 on October 9.supported

Basis: reported finding

Link to claim
CLM-HERMES-PKCE-PATCHTenable lists Hermes Agent versions before 0.21.6 as affected and advises upgrading to 0.21.6 or later.supported

Basis: reported finding

Link to claim
CLM-HERMES-PKCE-PARSERHermes Agent validated the native authorization redirect_uri with Python urlparse but reused the raw unnormalized URL in browser navigation; backslashes were interpreted differently by Python and the browser, making a server-approved loopback host differ from the browser destination.supported

Basis: reported finding

Link to claim
CLM-HERMES-PKCE-TAKEOVERTenable reproduced browser navigation that leaked PKCE authorization parameters to the wrong origin; because the attacker could choose the PKCE challenge, the researcher assessed that the code could be exchanged for victim session tokens.supported

Basis: reported finding

Link to claim
CLM-HERMES-PKCE-CANONICAL-FIXNousResearch merged pull request #130685 on October 1, 2026. It rejects noncanonical native callback addresses including backslashes and user information, canonicalizes allowed loopback URLs before storing them, and includes regression cases for browser/server authority mismatches.supported

Basis: reported finding

Link to claim

Implications

An agent dashboard can lose authentication authority before a model or its tools run. URL normalization must agree across the server and the browser.

Controls and mitigations

  • Upgrade affected Hermes Agent installations to 0.21.6 or later and verify the running application image, not just checked-out source.
  • Accept only canonically parsed and re-serialized loopback callback URLs; reject ambiguous separators and authorities before issuing authorization codes.
  • Bind the PKCE transaction and callback to the intended client and detect unexpected authorization redirects.

Unknowns and contradictions

  • The advisory describes a researcher reproduction, not a verified compromise of production users.
  • The number of installations exposing the vulnerable authorization flow is not established.

Sources and citation

EvidenceTenable TRA-2026-65: Hermes Agent PKCE Session Takeover via Redirect-URI Parser ConfusionEvidenceHermes Agent pull request 130685: canonical native sign-in callbackEvidenceNousResearch Hermes Agent v0.21.6 release and security fixes

Material revision history

  1. Oct 10, 2026 · Published version · first publication · revision 120
Record metadata

Canonical ID: CASE-2026-HERMES-PKCE-REDIRECT-TAKEOVER · revision 120

Legacy date (semantics unspecified): 2026-10-09. This value is not treated as an occurrence or disclosure date.