macOS versions after 10.12.6 include flaw that unlocks system preferences App Store menu with any password, if locked by admin; fix coming in macOS 10.13.3
which lets a logged-in admin user change App Store preferences by entering any random or no password at all. Here's the details. http://openradar.appspot.com/ ... http://twitter.com/...
Context & Ripple Effects
This lands six weeks after the High Sierra root bug let anyone authenticate as root with an empty password — and two months after Apple patched an APFS Disk Utility flaw that displayed passwords outright alongside a Keychain dump vulnerability. The new defect is smaller in scope but sits in the same layer: macOS's own credential checks inside System Preferences.
The pattern matters because these are not exotic exploits — they are failures of basic password validation shipping in released builds, discovered by outsiders via open radar reports rather than caught by Apple's own testing before users did.
First-order effects
- Admins running any macOS version after 10.12.6 cannot rely on locking the App Store preferences pane — anyone at the machine who is already logged in as an admin can change those settings with a random or blank password.
- The affected population is broad precisely because the flaw spans every release since 10.12.6 rather than being confined to one version, and relief only arrives when 10.13.3 ships.
Second-order effects
- Coming so soon after the root-authentication bug, each new disclosure raises the cost of Apple's silence between discovery and patch — enterprise Mac buyers have fresh evidence that upgrade timing now carries authentication risk.
- Security researchers get a proven playbook: probing System Preferences' password prompts has yielded repeated finds, which invites more probing of adjacent panes before Apple hardens them.
Third-order effects
- If the cadence holds — a major credential-handling flaw surfacing every few months across 2015's admin-framework backdoor, 2016's FileVault Thunderbolt theft, and 2017's root and Keychain bugs — Apple faces structural pressure to treat its own password-validation code as a tested surface, not just external attack vectors.
- Repeated self-inflicted authentication failures could push security-conscious buyers toward treating point-update urgency as mandatory rather than optional, changing how macOS update cycles are consumed.
The trend: macOS authentication defects keep surfacing in Apple's own shipped credential-checking code, turning each release cycle into a test of whether the company can catch basic password-validation failures before researchers do.