OpenNHP versions through 1.0.2 contain a vulnerability where the trusted-execution attestation verifier is selected based on attacker-supplied evidence containing a test_purpose key. This causes the FallbackVerifier to execute unconditionally, allowing attackers to bypass attestation verification by including this key and providing valid enrolled measure and serial number pairs from the allowlist, resulting in unauthorized access.