CVE-2026-92792: OpenNHP through 1.0.2 Authentication Bypass via Fallback Verifier
OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker-supplied evidence containing a testpurpose key, causing the FallbackVerifier to execute unconditionally. Attackers can bypass attestation verification by including the testpurpose key in evidence and providing enrolled measure and serial number pairs from the allowlist to gain unauthorized access.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to bypass attestation verification?
The attacker must be able to submit attestation evidence containing the test_purpose key and provide a measure and serial-number pair that is enrolled in the allowlist. No authentication or user interaction is required according to the supplied vector.
Which deployments are exposed?
OpenNHP versions through 1.0.2 are affected where trusted-execution attestation is used to control access. Exposure depends on an attacker being able to provide evidence to the verifier and obtain or supply an allowlisted measure and serial-number pair.
How can I determine whether an access event may have used this bypass?
Review submitted attestation evidence for the presence of the test_purpose key, especially for access events accepted using enrolled measure and serial-number pairs. The provided information does not identify any additional logging indicators.