PT-2026-2122 · Casaos+1 · Casaos+1

Captain-Noob · Published 2026-01-08 · Updated 2026-01-08 · CVE-2026-21891

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZimaOS versions up to and including 1.5.0

Description ZimaOS, a fork of CasaOS, experiences an authentication bypass issue in versions up to and including 1.5.0. The application validates usernames but improperly handles password validation for known system service accounts. Specifically, the login function fails to correctly process the password validation result for these users, granting authenticated access to anyone knowing a valid system username, regardless of the provided password. The vulnerable component is the login function. The username parameter is used in the authentication process.

Recommendations Versions up to and including 1.5.0 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-21891

GHSA-XJ93-QW9P-JXQ4

Affected Products

Casaos

Zimaos

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21891.json · Exploit
• 🔥 https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-xj93-qw9p-jxq4 · Exploit
• https://osv.dev/vulnerability/CVE-2026-21891 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21891 · Security Note
• https://twitter.com/CVEnew/status/2009277048666132694 · Twitter Post
• https://twitter.com/0dayPublishing/status/2009266571324072388 · Twitter Post
• https://twitter.com/CveFindCom/status/2009273638369808601 · Twitter Post
• https://t.me/CVEtracker/41719 · Telegram Post
• https://twitter.com/TheHackerWire/status/2009278939676434527 · Twitter Post