Major macOS High Sierra Bug Allows Full Admin Access Without Password - How to Fix [Updated]

[Porco]

First time I tried it didn't work. Second time it did.

That's a doozy! Sort it out Apple.

 

[Dundurs]

On the latest Beta you can use username root and the pasword root. Stupid!

 

[VulchR]

I'm still running 10.10.x ... *cough*

 

[gnurf]

Not saying this isn't bad, but isn't the default to not have guest accounts?

Except for at least two or three stores with demo computers in my area.

 

[bbfc]

On the latest Beta you can use username root and the pasword root. Stupid!

Tried that. Still can't replicate.

 

[CJM]

Christ, that's a bad one. Not going to hear the end of this for a while.

 

[WannaGoMac]

Yep why I didnt upgrade. Apple is like Microsoft now, wait several releases for all the bugs to shake out.

 

[OldSchoolMacGuy]

You're telling me people leaving their computers unlocked and highly insecure and logged in is an issue?! No way!!!!

 

[Altis]

Admin account. I only have the one account. Tried this numerous times. It does not work for me.

Did you put the cursor into the password entry field?

 

[WildCowboy]

How many people have their computer set up with guest accounts (especially with a non-trivial root password)?

Not saying this isn't bad, but isn't the default to not have guest accounts?

I'd imagine a lot of people have guest accounts (they're convenient) turned on and have no idea what root is.

 

[bbfc]

Did you put the cursor into the password entry field?

I tried again. Entered root as the username in the first dialog box, left password blank. Entered root again in the second prompt, left password blank. And it worked!!

 

[912181]

Has anyone checked 10.12.6? Don't have access to my laptop at the moment to check.

 

[blackxacto]

It took two tries, but it works perfectly. Ain't that great? All my passwords & encryption for naught.

17,1 iMac macOS 10.13.1

 

[TriBruin]

You're telling me people leaving their computers unlocked and highly insecure and logged in is an issue?! No way!!!!

Did you read the article? This works at the LOGIN screen as well. I have confirmed that I can log out of my own account and log in to the PC as the user ROOT with no password.

Accept this is a MAJOR security hole. Root access to ANY computer is potentially fatal to the computer.

 

[kometen]

Doesn't work for me on 10.13.1, even after a few tries. False alarm? Or some other obscure setting needed as well?

Nope, true. Works here, I mean, the bug is present.

 

[Baletin]

confirmed on 2nd try

 

[Wildkraut]

Let’s see how long it will take to get fixed.
In the meantime, any ATMs running macs?

 

[kissmo]

Works on the second try. First time is shakes the window. Second time you press unlock - it works.

 

[shareef777]

This is pathetic. I'm willing to bet we won't hear a peep about this. They'll just quietly patch this and act like it never happened. And we'll all quietly forget that it happened as well.

 

[noraa]

Oy, not sure how that one slipped through the cracks. I wonder how the developer discovered the issue? Trial and error or found something in the source code. Regardless, despite the doom and gloom tone to most of these posts, I’m sure Apple will get this fixed ASAP and we’ll move on with our lives.

 

[SqB]

On the latest Beta you can use username root and the pasword root. Stupid!

are you seeing this in the terminal? SSH? I've been trying a few things to try to see if the issue can be replicated on the command line, but have not had success. Seems like the GUI is the only place to replicate the issue.

 

[JosephAW]

Welcome to OS X 10.0 again. Glad I stayed on El Captain and Sierra and iOS 10

 

[bbfc]

So I did finally get this to work. Set a root password for now. I presume this will get fixed ASAP.

 

[TheTissot11]

This is a slap on Federighi's face considering his constant ranting about macOS becoming great under his leadership...

 

[farawayfrome]

on my recently repaired mbp the name 'root' is already being used by another user