EUVD-2026-71096Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
AC:H because triggering the flaw requires a specific non-default build-host misconfiguration (wrong mkpasswd package or old libxcrypt); all other metrics follow the vendor vector.
Primary rating from Vendor (5a6e4751-2f3f-4070-9419-94fb35b644e8).
CVSS VectorVendor: 5a6e4751-2f3f-4070-9419-94fb35b644e8
Lifecycle Timeline
5DescriptionCVE.org
(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command's return value and unconditionally accepts the result. If mkpasswd fails to generate a yescrypt hash, for example because an incompatible mkpasswd implementation or an environment without yescrypt support is used, the resulting password hash variable can be empty and the build proceeds. The resulting image can therefore contain empty password fields for the root and alpha accounts, potentially permitting passwordless authentication depending on the authentication configuration.
AnalysisAI
Fail-open password validation in Chew, Kean Ho's Actualizer v1.2.0 installer allows a build host with an incompatible mkpasswd implementation to produce Debian images with empty root and alpha account password fields. The installer script Shell/debian-minbase-install.sh invokes mkpasswd to generate yescrypt hashes but never validates whether the output is a valid yescrypt hash or even non-empty, proceeding unconditionally when mkpasswd silently fails. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability triggers at BUILD time, not at runtime. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 7.9 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) captures the scope-change dynamic well: a build-time flaw propagates into deployed images, affecting all users of those images. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Actualizer v1.2.1, available at https://github.com/ChewKeanHo/software-actualizer/releases/tag/v1.2.1, which introduces both a pre-flight yescrypt compatibility check and post-generation hash validation against the '$y$' prefix in each password loop. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit build logs from Actualizer v1.2.0 deployments to identify any instances where mkpasswd failed silently during image generation, and document which systems may have been affected. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-252 – Unchecked Return Value
View allShare
External POC / Exploit Code
Leaving vuln.today