EUVD-2026-81055
GHSA-wj5x-jrhc-mqcx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated bypass (AV:N/PR:N/UI:N) yielding unauthorized access mapped to C:H; I:N/A:N per vendor impact; AC:L retained though needing allowlisted measure/serial pairs arguably justifies AC:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker-supplied evidence containing a test_purpose key, causing the FallbackVerifier to execute unconditionally. Attackers can bypass attestation verification by including the test_purpose key in evidence and providing enrolled measure and serial number pairs from the allowlist to gain unauthorized access.
AnalysisAI
Authentication bypass in OpenNHP through 1.0.2 allows remote unauthenticated attackers to defeat trusted-execution attestation verification by supplying evidence that includes a test_purpose key, which forces the FallbackVerifier to execute unconditionally. Attackers must also provide enrolled measure and serial-number pairs that already exist in the allowlist, which is the primary real-world limiter on exploitability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to (1) submit attestation evidence containing the specific test_purpose key, which alone forces the FallbackVerifier to run unconditionally, and (2) provide enrolled 'measure' and 'serial number' pairs that already exist in the OpenNHP allowlist. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority authentication bypass, though the raw CVSS 4.0 score of 8.7 slightly overstates unconditional trivial exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version was identified from the available data at time of analysis; monitor the OpenNHP GitHub issue https://github.com/OpenNHP/opennhp/issues/1732 and the VulnCheck advisory https://www.vulncheck.com/advisories/opennhp-through-1.0.2-authentication-bypass-via-fallback-verifier for a fixed release, and upgrade beyond 1.0.2 as soon as a patched version is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, restrict network access to OpenNHP attestation services to trusted internal networks only and enable detailed logging of all attestation requests to detect attempts to supply test_purpose keys or anomalous measure/serial-number pairs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allow
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. Rated high severity (CVS
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command executi
Denial of service in Go's net/url package allows remote unauthenticated attackers to crash applications via malformed UR
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query p
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today