CVE-2026-21891 ZimaOS has Authentication Bypass via System-Level Username

Critical 9.4 Published 8 Jan 2026 Updated 8 Jan 2026

Attackers can bypass authentication in ZimaOS by using known system service usernames with any password, gaining unauthorized access.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-21891?

CVE-2026-21891 is a critical authentication bypass vulnerability in IceWhaleTech ZimaOS, published on 8 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions up to and including 1.5.0, the application checks the validity of the username but appears to skip, misinterpret, or incorrectly validate the password when the provided username matches a known system service account. The application's login function fails to properly handle the password validation result for these users, effectively granting authenticated access to anyone who knows one of these common usernames and provides any password. As of time of publication, no known patched versions are available.

Weakness: CWE-287

Which versions are affected by CVE-2026-21891?

It affects 1 product.

Products include Zimaspace Zimaos.

How do I fix CVE-2026-21891?

No fix has been published for CVE-2026-21891 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-21891 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-21891 exists.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-xj93-qw9p-jxq4.