How to fix the MacOS High Sierra password bug

A bug in MacOS High Sierra allowed anyone to log into your Mac without a password. Apple has now issued a fix.

Taylor Martin CNET Contributor
Taylor Martin has covered technology online for over six years. He has reviewed smartphones for Pocketnow and Android Authority and loves building stuff on his YouTube channel, MOD. He has a dangerous obsession with coffee and is afraid of free time.
Matt Elliott Senior Editor
Matt Elliott is a senior editor at CNET with a focus on laptops and streaming services. Matt has more than 20 years of experience testing and reviewing laptops. He has worked for CNET in New York and San Francisco and now lives in New Hampshire. When he's not writing about laptops, Matt likes to play and watch sports. He loves to play tennis and hates the number of streaming services he has to subscribe to in order to watch the various sports he wants to watch.
Expertise Laptops | Desktops | All-in-one PCs | Streaming devices | Streaming platforms
Taylor Martin
Matt Elliott
3 min read

bug was discovered in MacOS High Sierra on Tuesday that allows anyone to log in to your computer using the username "root" with no password.

Originally brought to light on Twitter by developer Lemi Orhan Ergin, the bug appeared when you opened System Preferences and go to Users & Groups. To make changes in this menu normally requires a password -- you have to click the padlock icon in the lower left corner, which prompts you to enter a username and password. Thanks to the bug, however, one could simply enter "root" as the username and leave the password field blank. 

It may not work the first time, but trying it additional times will unlock the padlock, giving anyone access to your computer. In our testing, it only took two attempts to unlock the padlock and gain access to an administrator account without a password. After using this root trick in System Preferences, we were then able to log into a locked Mac by choosing Other in the login screen and then entering "root" and no password.

Watch this: Apple's huge password bug in Macs can be fixed

On Wednesday, Apple released a security update to patch this vulnerability. Open the Mac App Store and click the Updates tab to install Security Update 2017-001.

An Apple spokesperson gave this statement:

Security is a top priority for every Apple product, and regrettably we stumbled with this release of MacOS.

When our security engineers became aware of the issue Tuesday afternoon, we immediately began working on an update that closes the security hole. This morning, as of 8 a.m., the update is available for download, and starting later today it will be automatically installed on all systems running the latest version (10.13.1) of MacOS High Sierra.

We greatly regret this error and we apologize to all Mac users, both for releasing with this vulnerability and for the concern it has caused. Our customers deserve better. We are auditing our development processes to help prevent this from happening again.

Before this update was released, there was a quick fix for the vulnerability, thanks to iMore: set a password for the root user on your Mac. Should this ever arise again, here's how to do it.

Taylor Martin/CNET
  • Click the Apple logo in the menu bar and select System Preferences (or search for it in Spotlight).
  • Click Users & Groups.
  • Click the padlock icon in the lower-left corner.
  • Enter the password for your username.
  • Click Login Options.
  • Click Join or Edit next to Network Account Server.
  • Click Open Directory Utility…
  • Click the padlock icon in the lower-left corner and enter your password once more.
  • In the menu bar, click Edit and select Enable Root User. If root user is already enabled, click Change Root Password…
  • Enter a secure password and enter it a second time to verify.
  • Click OK to finish.

Once you've set a root password, the exploit will no longer work, but we urge you to download the update in any case.

First published Nov. 28, 3:45 p.m PT.
Update, Nov. 29 10:23 a.m. PT: Adds a statement from Apple and details about the security update it released.