CVE-2026-21891 is an authentication bypass in ZimaOS, scored 9.4 (Critical). The login function skips proper password validation when the username matches a known system service account, so any password works for those names. The advisory lists 1.5.3 as the patched version, so update every ZimaOS device and keep them off the public internet.
What's affected
- Product: ZimaOS, a fork of CasaOS for Zima devices and x86-64 systems with UEFI (IceWhale)
- Affected: versions up to and including 1.5.0
- Fixed: 1.5.3, per the GitHub advisory
- Entry point: the user login endpoint
- Status: not in the CISA Known Exploited Vulnerabilities catalog
The NVD text says no patched version was available when it was published. The advisory we checked now lists 1.5.3 as patched.
How to check if you're exposed
Check the version in the ZimaOS settings, or from a shell on the device if you have one. Anything at 1.5.0 or below is affected.
Then check how the device is reachable. If its web interface is open to the internet, through a port forward or a tunnel, treat it as exposed. If it only answers on your home or office network, the risk is lower but still real for anyone on that network.
Review accounts on the device and look at login history if the system keeps one. An unexpected successful login for a system service name is worth investigating.
What to do now
- Update every ZimaOS device to 1.5.3 or later.
- Remove any port forwards or public tunnels to the ZimaOS web interface. Use a VPN for remote access.
- Check what the device stores and what it can reach, and change credentials for anything an unexpected login could have exposed.
- Review logins and installed apps for changes you did not make.
- Keep automatic updates on, so the next fix does not wait for you.
Why it matters
The login code checks that the username is valid. For common system account names, it then handled the password check incorrectly, and the result was access with any password. The advisory lists names such as root, daemon and others that exist on Linux systems by default, which is why guessing them takes no effort. The weakness is CWE-287, improper authentication.
Home servers and small network storage boxes are a common place for this kind of mistake. They are often exposed to the internet for convenience and rarely get the review a larger product does. A critical authentication flaw on a device that holds personal files or runs containers has a wide reach: whoever logs in can use everything the device does.
Treat any self-hosted system with a web login as part of your attack surface. Know the version, patch it, and do not expose it directly.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to know a password?
Per the advisory, no. For the system service account names it lists, any password is accepted. That is why updating matters more than password strength.
Is a password change a fix?
No. The flaw is in how the login code handles the result of the check, so a stronger password does not help. Update to 1.5.3.
Sources
Last reviewed: 19 October 2026.
