2 ms·

Confirmed that root with no password unlocks the preferences pane. But, changing the require password after screen saver setting doesn't take effect. So, it see

by josho 9y ago

Confirmed that root with no password unlocks the preferences pane. But, changing the require password after screen saver setting doesn't take effect. So, it seems to be a bug in the UI not an actual vulnerability. edit: I stand corrected. The 'require password' setting under Security Preferences didn't change, but other settings do. Yikes

jameskilton 9y ago
Oh this is a real vulnerability. It's possible to switch your user to System Administrator using "root" and no password.
vladikoff 9y ago
I have "Guest User" disabled normally. This allowed me to switch Guest User on, log out, login as `root` into OS X. lol
nsnick 9y ago
10.13.1 can't make it happen