OpenNHP CVE-2026-92792

Exploitation requires the attacker to (1) submit attestation evidence containing the specific test_purpose key, which alone forces the FallbackVerifier to run unconditionally, and (2) provide enrolled 'measure' and 'serial number' pairs that already exist in the OpenNHP allowlist. The second requirement is the primary real-world limiter: the attacker must know or obtain valid allowlisted measure/serial pairs, so exploitation is not purely opaque despite the PR:N/UI:N vector. Applies to OpenNHP versions through 1.0.2 with the trusted-execution attestation verification path in use; no authentication or user interaction is otherwise required.

This is a genuine high-priority authentication bypass, though the raw CVSS 4.0 score of 8.7 slightly overstates unconditional trivial exploitability. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) indicates network-reachable, unauthenticated, low-complexity exploitation with high confidentiality impact and no integrity or availability impact - consistent with CWE-287 attestation bypass yielding unauthorized access. The core logic flaw is real and severe: the FallbackVerifier is selected purely from attacker-controlled evidence (a test_purpose key), and the vulnerable code path is pinpointed at nhp/core/verifier/verifier.go lines 27-92. However, exploitation is not fully unconditional: the description states the attacker must ALSO supply enrolled measure and serial-number pairs drawn from the allowlist, which is a knowledge prerequisite the AC:L/AT:N metrics do not fully capture (arguably AC:H). No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so there is no evidence of active exploitation; risk is currently theoretical-but-serious. This was reported by VulnCheck (a credible source) with a dedicated advisory and a public GitHub issue, which lends confidence to the technical accuracy even without a POC.

A remote unauthenticated attacker crafts attestation evidence that includes a test_purpose key, which forces OpenNHP to invoke the FallbackVerifier unconditionally instead of a real trusted-execution attestation check. By additionally supplying valid enrolled measure/serial-number pairs from the allowlist, the attacker passes verification and gains unauthorized access to the protected resource. No public exploit code was identified at time of analysis, but the flaw and its exact code location are documented in the VulnCheck advisory and GitHub issue #1732.