macOS High Sierra: Anyone can login as “root” with empty password
Apple makes it pretty easy to report vulnerabilities to:<p>product-security@apple.com<p>They also respond to security@apple.com but prefer the product-security address.<p>Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed.<p>Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even if it is local: think of the impact to shared iMacs on university campuses.