{"repo":"NousResearch/hermes-agent","public_id":"44729","display_label":"SimpleX allowlist bypass via display name collision","summary":"A security vulnerability where the SimpleX gateway allowlist authorization can be bypassed by using a colliding contact display name. Members include the vulnerability reports and a related fix removing mutable display-name from the allowlist check.","subsystem":"gateway","counts":{"members":4,"open_issues":1,"open_issues_distinct":1,"open_prs":1,"closed_issues":1,"merged_prs":1,"attempt_prs":1},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":125034,"merged_at":"2026-09-27T15:17:42+00:00"},"resolution":{"state":"partially_resolved","by":"pr-125034"},"freshness":{"state":"verified","last_verified_at":"2026-09-27T15:17:42+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_PARTIAL","link_density":0.3933333333333333},"fix_edges":[{"issue_number":44729,"pr_number":125034,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-27T15:17:42+00:00"}],"members":[{"kind":"issue","number":44729,"title":"[Security] Hermes SimpleX sender allowlist can be bypassed via colliding display name on upstream main","url":null,"state":"closed"},{"kind":"issue","number":44730,"title":"[Security] Hermes SimpleX gateway allowlist authorization bypass via colliding contact display name","url":null,"state":"open"},{"kind":"pr","number":44741,"title":"fix(security): remove mutable display-name from SimpleX allowlist check","url":null,"state":"open","close_reason":{"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":125034,"title":"fix(simplex): authorize by contactId only, not the sender's display name","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["gateway/authz_mixin.py","plugins/platforms/simplex/adapter.py","tests/gateway/test_simplex_plugin.py","tests/gateway/test_unauthorized_dm_behavior.py","website/docs/user-guide/messaging/simplex.md"]}],"trust":{"default_tier":"verified","includes_suggested":false}}