CVE-2026-92792: OpenNHP Authentication Bypass Vulnerability

CVE-2026-92792 Overview

CVE-2026-92792 is an authentication bypass vulnerability in OpenNHP through version 1.0.2. The flaw resides in the attestation verifier selection logic used to validate trusted-execution evidence. OpenNHP selects its verifier based on attacker-controlled evidence containing a test_purpose key, which causes the FallbackVerifier to execute unconditionally. An unauthenticated remote attacker can bypass attestation verification by supplying the test_purpose key along with enrolled measure and serial number pairs from the allowlist. Successful exploitation grants unauthorized access to protected resources. The weakness maps to [CWE-287: Improper Authentication].

Critical Impact

Remote, unauthenticated attackers can bypass trusted-execution attestation and gain unauthorized access to systems protected by OpenNHP.

Affected Products

• OpenNHP through 1.0.2
• Deployments using the FallbackVerifier attestation logic in nhp/core/verifier/verifier.go
• Systems relying on OpenNHP for zero-trust network access based on TEE attestation

Discovery Timeline

• 2026-09-16 - CVE-2026-92792 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92792

Vulnerability Analysis

OpenNHP is an open-source implementation of the Network-resource Hiding Protocol that uses trusted-execution environment (TEE) attestation to authorize network access. The verifier component chooses which attestation validator to run based on fields inside the evidence payload submitted by the client. When the evidence contains a test_purpose key, the selection logic dispatches to FallbackVerifier, a permissive validator intended only for testing. Because the routing decision trusts attacker-supplied evidence, any remote client can force the fallback path. Once inside FallbackVerifier, the check only requires that the submitted measure and serial number pair appears in the allowlist. Attackers who obtain any enrolled pair, which is not treated as a secret, complete attestation without possessing a genuine TEE quote. The verifier source is available in the OpenNHP verifier code.

Root Cause

The root cause is a trust boundary violation in the verifier dispatcher. The code uses attacker-controlled evidence fields to select the security-critical verification routine. A test-only code path was left reachable in production builds and gated only by a caller-supplied flag rather than a build-time or configuration-time constant.

Attack Vector

Exploitation occurs over the network with no authentication and no user interaction. An attacker crafts an attestation evidence payload that includes the test_purpose key and a valid measure and serial number pair from the OpenNHP allowlist. The server routes the request to FallbackVerifier, which accepts the evidence and issues valid session state, granting access to protected services. Additional details are documented in the VulnCheck advisory for the OpenNHP fallback verifier bypass and OpenNHP issue #1732.

Detection Methods for CVE-2026-92792

Indicators of Compromise

• Attestation evidence payloads containing the test_purpose key received by production OpenNHP servers.
• OpenNHP server logs showing invocations of FallbackVerifier outside of controlled test environments.
• Successful access grants from clients that never submitted a genuine TEE quote or platform report.

Detection Strategies

• Inspect OpenNHP verifier logs for the code path selected during each attestation and alert whenever FallbackVerifier is chosen.
• Correlate successful NHP access grants with the presence of test_purpose in the associated evidence structure.
• Baseline the set of measure and serial number pairs seen at attestation time and flag reuse from unexpected source addresses.

Monitoring Recommendations

• Forward OpenNHP application logs to a centralized analytics platform for continuous review of verifier decisions.
• Alert on network flows to services normally gated by OpenNHP that lack a corresponding hardware-backed attestation event.
• Track the enrollment status and distribution of measure and serial number allowlists to reduce credential-like exposure.

How to Mitigate CVE-2026-92792

Immediate Actions Required

• Upgrade OpenNHP to a version later than 1.0.2 once a fixed release is published by the project maintainers.
• Remove or disable the FallbackVerifier code path in any deployment built from source until a patched release is available.
• Rotate and re-enroll measure and serial number pairs that may have been exposed, treating them as sensitive material.

Patch Information

At the time of publication, no fixed version is listed in NVD. Monitor the OpenNHP GitHub repository and issue #1732 for a security release. Rebuild from a commit that removes attacker-controllable dispatch to FallbackVerifier and enforces genuine TEE quote validation.

Workarounds

• Strip or reject any incoming attestation evidence containing the test_purpose key at a network proxy in front of OpenNHP.
• Restrict OpenNHP management and attestation endpoints to trusted networks using firewall or service mesh policy.
• Enforce hardware-backed attestation only by patching the verifier to hard-code the production validator selection.

# Configuration example: block evidence containing test_purpose at an ingress proxy
# (nginx example - adjust to your environment)
location /nhp/attest {
    if ($request_body ~* "test_purpose") {
        return 403;
    }
    proxy_pass http://opennhp_backend;
}