macOS High Sierra: Anyone can login as “root” with empty password
Apple makes it pretty easy to report vulnerabilities to:product-security@apple.comThey also respond to security@apple.com but prefer the product-security address.Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed.Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even if it is local: think of the impact to shared iMacs on university campuses.