CVE-2026-85649: CWE-636: Not Failing Securely (Failing Open) in chewkeanho software-actualizer

CVE-2026-85649 describes a fail-open password validation vulnerability in Chew, Kean Ho's Actualizer software-actualizer v1.2.0 and earlier. The installation script Shell/debian-minbase-install.sh invokes mkpasswd to generate yescrypt password hashes for the Alpha and root user accounts but does not check the command's return value. If mkpasswd fails (e.g., due to incompatible implementation or lack of yescrypt support), the resulting password hash variable can be empty. The build process continues regardless, potentially resulting in an image with empty password fields for critical accounts. This vulnerability is classified as CWE-636 (Not Failing Securely) and CWE-252 (Unchecked Return Value).

The vulnerability can lead to passwordless authentication for the root and alpha user accounts if the mkpasswd command fails during installation, potentially allowing unauthorized privileged access. The CVSS 3.1 score is 7.9 (high), reflecting local attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high confidentiality and integrity impact but no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should verify the mkpasswd command's success during installation and ensure the environment supports yescrypt. Avoid using incompatible mkpasswd implementations or environments lacking yescrypt support to prevent empty password hashes.