CVE-2026-21891

CriticalPublic PoC

Published: 08 January 2026

Published

08 January 2026

Modified

12 January 2026

KEV Added

—

Patch

—

CVSS Score 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

EPSS Score 0.1137 93.6th percentile

Risk Priority 26 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-21891 is a critical-severity Improper Authentication (CWE-287) vulnerability in Zimaspace Zimaos. Its CVSS base score is 9.4 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and IA-2 (Identification and Authentication (Organizational Users)).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

IA-2 Identification and Authentication (Organizational Users) good match

prevent

Requires systems to implement robust identification and authentication mechanisms that properly validate both usernames and passwords for all accounts, directly preventing the authentication bypass for known system service accounts in ZimaOS.

AC-2 Account Management good match

prevent

Mandates account management including identification, review, and disabling of unnecessary or risky system service accounts, blocking exploitation via known usernames with arbitrary passwords.

SI-2 Flaw Remediation good match

prevent

Requires timely identification, reporting, and remediation of flaws such as the improper password handling in ZimaOS login function, eliminating the authentication bypass vulnerability through patching.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1078.001 Default Accounts Stealth

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

attack.mitre.org →

Why these techniques?

CVE enables exploitation of a public-facing application (T1190) via authentication bypass for known system service accounts (facilitating T1078.001: Default Accounts).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions up to and including 1.5.0, the application checks the validity of the username but appears to skip, misinterpret, or incorrectly validate…

the password when the provided username matches a known system service account. The application's login function fails to properly handle the password validation result for these users, effectively granting authenticated access to anyone who knows one of these common usernames and provides any password. As of time of publication, no known patched versions are available.

Deeper analysisAI

CVE-2026-21891 is an authentication bypass vulnerability affecting ZimaOS, a fork of CasaOS designed as an operating system for Zima devices and x86-64 systems with UEFI support. In versions up to and including 1.5.0, the login function properly validates usernames but skips, misinterprets, or incorrectly handles password validation when the username matches a known system service account. This results in any password being accepted for these accounts, granting unauthorized authenticated access. The vulnerability carries a CVSS v3.1 base score of 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) and is associated with CWE-287 (Improper Authentication).

Remote attackers require no privileges or user interaction to exploit this issue over the network with low complexity. By providing a known system service account username paired with any arbitrary password, an attacker can successfully authenticate and gain access to the affected system's administrative or service-level functions, potentially leading to high-impact confidentiality and integrity violations, such as data exfiltration or system modification, alongside limited availability disruption.

The primary advisory from IceWhaleTech on GitHub (GHSA-xj93-qw9p-jxq4) confirms the issue and notes that, as of the CVE publication on January 8, 2026, no patched versions of ZimaOS are available. Security practitioners should monitor for updates from the vendor, restrict network exposure of ZimaOS instances, and consider implementing network-level access controls or disabling the affected login endpoint until a fix is released.