CVE-2026-85649
7.9
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Exploitability: 1.5 / Impact: 5.8
Source: 5a6e4751-2f3f-4070-9419-94fb35b644e8 (Secondary)
Description
(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command's return value and unconditionally accepts the result. If mkpasswd fails to generate a yescrypt hash, for example because an incompatible mkpasswd implementation or an environment without yescrypt support is used, the resulting password hash variable can be empty and the build proceeds. The resulting image can therefore contain empty password fields for the root and alpha accounts, potentially permitting passwordless authentication depending on the authentication configuration.
Related CWEs
CWE-252
Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CWE-636
Not Failing Securely ('Failing Open')
When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
References (4)
Source: 5a6e4751-2f3f-4070-9419-94fb35b644e8
Source: 5a6e4751-2f3f-4070-9419-94fb35b644e8
Source: 5a6e4751-2f3f-4070-9419-94fb35b644e8
Source: 5a6e4751-2f3f-4070-9419-94fb35b644e8
Timeline
No history available yet.