CVE-2026-92792 OpenNHP through 1.0.2 Authentication Bypass via Fallback Verifier
Attackers can bypass attestation verification in OpenNHP by injecting a test_purpose key, gaining unauthorized access to the system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92792?
CVE-2026-92792 is a high-severity authentication bypass vulnerability in opennhp, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker-supplied evidence containing a test_purpose key, causing the FallbackVerifier to execute unconditionally. Attackers can bypass attestation verification by including the test_purpose key in evidence and providing enrolled measure and serial number pairs from the allowlist to gain unauthorized access.
Weakness: CWE-287
Which versions are affected by CVE-2026-92792?
How do I fix CVE-2026-92792?
No fix has been published for CVE-2026-92792 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-92792 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92792 exists.
Sources
Also known as GHSA-wj5x-jrhc-mqcx.