(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command's return value and unconditionally accepts the result. If mkpasswd fails to generate a yescrypt hash, for example because an incompatible mkpasswd implementation or an environment without yescrypt support is used, the resulting password hash variable can be empty and the build proceeds. The resulting image can therefore contain empty password fields for the root and alpha accounts, potentially permitting passwordless authentication depending on the authentication configuration.

CVE-2026-85649 affects (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier, specifically in the Shell/debian-minbase-install.sh installer script. The vulnerability is a fail-open password validation flaw where the installer calls mkpasswd to generate yescrypt password hashes for root and Alpha user accounts but fails to check the command's return value. If mkpasswd fails due to an incompatible implementation or lack of yescrypt support, the resulting password hash variable may be empty. The build process continues regardless, potentially producing system images with empty password fields for privileged accounts. This could allow passwordless authentication for root and Alpha users depending on system authentication configuration. The vulnerability is patched in version v1.2.1, with a fix committed to the project repository. References include a Zenodo publication, the vulnerable source code line, a patch commit, and the fixed release.