Opennhp
Monthly
Authentication bypass in OpenNHP through 1.0.2 allows remote unauthenticated attackers to defeat trusted-execution attestation verification by supplying evidence that includes a test_purpose key, which forces the FallbackVerifier to execute unconditionally. Attackers must also provide enrolled measure and serial-number pairs that already exist in the allowlist, which is the primary real-world limiter on exploitability. No public exploit code was identified at time of analysis, and the issue is not listed in CISA KEV; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates high confidentiality impact, though the raw CVSS 4.0 score of 8.7 slightly overstates unconditional trivial exploitability.
Authentication bypass in OpenNHP through 1.0.2 allows remote unauthenticated attackers to defeat trusted-execution attestation verification by supplying evidence that includes a test_purpose key, which forces the FallbackVerifier to execute unconditionally. Attackers must also provide enrolled measure and serial-number pairs that already exist in the allowlist, which is the primary real-world limiter on exploitability. No public exploit code was identified at time of analysis, and the issue is not listed in CISA KEV; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates high confidentiality impact, though the raw CVSS 4.0 score of 8.7 slightly overstates unconditional trivial exploitability.