Authentication Bypass in OpenNHP via Attestation Verification Manipulation

OpenNHP versions up to 1.0.2 are susceptible to an authentication bypass vulnerability involving the trusted-execution attestation process. The application insecurely selects its attestation verifier based on user-supplied evidence. Specifically, by injecting a 'test_purpose' key into the evidence payload, an attacker can force the application to default to the 'FallbackVerifier' regardless of the actual attestation context. By further providing enrolled measurement values and corresponding serial numbers - which may be obtained from existing allowlists - an attacker can satisfy the conditions required by the fallback logic. This flaw allows unauthorized entities to masquerade as valid devices or services, effectively bypassing the security controls intended to verify the integrity and identity of trusted execution environments. This vulnerability presents a high risk to environments relying on OpenNHP for identity and trust verification.

Impact

Successful exploitation allows for the complete bypass of attestation-based authentication mechanisms within the OpenNHP framework. This grants unauthorized actors the ability to gain access to restricted network segments or services that rely on these verification checks, potentially leading to unauthorized data access, system manipulation, or further lateral movement within the network.

Recommendation

1. Patch OpenNHP to the latest version available that addresses CVE-2026-92792 immediately.
2. If patching is not immediately feasible, restrict access to the attestation endpoints by implementing strict ingress filtering at the network level to limit the exposure of the management interface.
3. Audit application logs for anomalous attestation requests that include unusual keys such as 'test_purpose' in the payload.