Authentication Bypass in OpenNHP Affects Trusted Execution Attestation

CVE-2026-92792

What is CVE-2026-92792?

OpenNHP versions up to 1.0.2 exhibit a critical flaw where the trusted-execution attestation verifier relies on attacker-controlled evidence, specifically the 'test_purpose' key. This vulnerability allows attackers to bypass important attestation verification mechanisms, leading to unauthorized access. By exploiting this weakness, attackers can provide pairs of enrolled measure and serial numbers from the allowlist, enabling them to gain access without proper authentication.

References