A critical fail-open vulnerability in the Actualizer installation process can allow passwordless authentication for administrative accounts, creating a severe unauthorized access risk.

The installation script fails to validate the return value of the mkpasswd command when generating yescrypt hashes. If the command fails, the system proceeds with an empty password field, allowing potential passwordless login for the root and alpha accounts.

Successful exploitation allows an attacker to bypass authentication mechanisms entirely, granting them full control over the affected system. Given the CVSS score of 7.9, this vulnerability presents a high risk to system integrity and confidentiality, as it facilitates unauthorized administrative access that could lead to data exfiltration or complete system compromise.

Immediate Action: Upgrade to Actualizer version 1.2.1 or later, which includes proper pre-flight checks for yescrypt support and validates the generated password hash.

Proactive Monitoring: Review system access logs for any unauthorized login attempts or successful authentications involving empty passwords for the root or alpha accounts.

Compensating Controls: Ensure that systems deployed using affected versions have secondary authentication layers or network-level access controls to restrict access to the affected accounts until the patch is applied.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the associated GitHub repository.

Organizations utilizing Actualizer for automated system builds must prioritize upgrading to version 1.2.1 immediately. The severity of permitting passwordless root access necessitates an urgent review of all existing images built with vulnerable versions to ensure no unauthorized access has occurred.