CVE-2026-92792

HighCVSS 7.5/10Last modified Sep 22, 2026

Description

OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker-supplied evidence containing a test_purpose key, causing the FallbackVerifier to execute unconditionally. Attackers can bypass attestation verification by including the test_purpose key in evidence and providing enrolled measure and serial number pairs from the allowlist to gain unauthorized access.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-287

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
OpenNHP	opennhp	<= 1.0.2

References

Timeline

Published: Sep 16, 2026
Last modified: Sep 22, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-927938.1GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permiss CVE-2026-927947.5OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled.CVE-2026-927956.5Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the CVE-2026-927968.8Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing rea CVE-2026-927978.8The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a CVE-2026-927988.1The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2 CVE-2026-927995.3The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggli CVE-2026-92806.1The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Parameters in iframe CVE-2026-928006.8Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with re CVE-2026-928018.8cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. At CVE-2026-928024.3kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boa CVE-2026-928035.3LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated access to translated fi