Password Validation Flaw in Actualizer by Chew, Kean Ho
CVE-2026-85649

7.9HIGH

Key Information:

Vendor

Chewkeanho

Status
Software-actualizer
Vendor
CVE Published:
4 September 2026

What is CVE-2026-85649?

The Actualizer software by Chew, Kean Ho prior to version 1.2.1 exhibits a significant fail-open vulnerability in its password validation processes. Specifically, the installer script Shell/debian-minbase-install.sh fails to validate the success of the mkpasswd command when generating yescrypt password hashes. If mkpasswd does not produce a valid hash—potentially due to usage in a non-compatible environment or lack of yescrypt support—the script may proceed with an empty hash. Consequently, this flaw could lead to configurations that allow passwordless access for the root and alpha accounts, depending on the overall system's authentication settings.

Affected Version(s)

software-actualizer 0 <= 1.2.0

References

https://github.com/ChewKeanHo/software-actualizer/release...
release-notespatch
https://github.com/ChewKeanHo/software-actualizer/commit/...
patch
https://github.com/ChewKeanHo/software-actualizer/blob/v1...

CVSS V3.1

Score:
7.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alice Xiang Yu Xuan (湘渝萱)
(Holloway) Chew, Kean Ho
.