Tenable TRA-2026-65: Hermes Agent PKCE Session Takeover via Redirect-URI Parser Confusion

Evidence record

Researcher disclosure of a browser/server URL parser mismatch in the Hermes Agent PKCE authentication callback. Covers the mechanism, account-takeover consequence, pre-0.21.6 affected versions, patch and disclosure chronology.

Read the original source ↗

Claim-level citations (4)

• supportsHermes Agent PKCE callback trusted a loopback host the browser did not use: Tenable first contacted the maintainer on September 3, 2026, recorded a fix discussion on October 5, and first published TRA-2026-65 on October 9.

  Disclosure Timeline and Advisory Timeline: October 09, 2026 - Initial release

• supportsHermes Agent PKCE callback trusted a loopback host the browser did not use: Tenable lists Hermes Agent versions before 0.21.6 as affected and advises upgrading to 0.21.6 or later.

  Solution; Affected Products; Additional References to v0.21.6 release

• supportsHermes Agent PKCE callback trusted a loopback host the browser did not use: Hermes Agent validated the native authorization redirect_uri with Python urlparse but reused the raw unnormalized URL in browser navigation; backslashes were interpreted differently by Python and the browser, making a server-approved loopback host differ from the browser destination.

  Synopsis, paragraphs on /auth/native/authorize, _validate_loopback_redirect_uri and the Python/WHATWG parser disagreement

• supportsHermes Agent PKCE callback trusted a loopback host the browser did not use: Tenable reproduced browser navigation that leaked PKCE authorization parameters to the wrong origin; because the attacker could choose the PKCE challenge, the researcher assessed that the code could be exchanged for victim session tokens.

  Synopsis, paragraphs describing attacker-chosen PKCE challenge, redirected code/state and full session takeover