The vulnerability, called "Rootpipe," appears to have been discovered by Emil Kvarnhammar, a consultant at IT security firm TrueSec.
Rootpipe allows outside users to gain administrator-level access to Macs running OS X Yosemite, Mavericks, or Mountain Lion without a password.
The security flaw gives attackers the opportunity to steal information, install malicious programs, or erase users' hard drives.
Kvarnhammar, for his part, appears to be waiting for Apple to patch Rootpipe before saying much about it:
Rootpipe has probably been around since at least 2012, according to Swedish tabloid Aftonbladet.
We've reached out to Apple for comment and will update this post if we hear back.