An authentication issue in Apple’s operating systems was caused by improper state management, enabling a local network attacker to bypass the device’s authentication policy. The flaw conforms to CWE‑288, which concerns authorization or authentication failures. If exploited, an attacker could gain unauthorized access to the device, potentially reading or modifying data, and could exercise elevated privileges if the compromised account has higher authority. The impact is confinement to the local network and requires the attacker to be on the same physical or logical network segment as the target device.

Affected Apple platforms include iOS and iPadOS. Specific vulnerable releases are iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, and visionOS 2.4. No other versions are listed as affected.

The vulnerability carries a CVSS score of 7.7, indicating high severity, but its EPSS score is below 1%, reflecting a very low likelihood of current exploitation. It is not listed in the CISA KEV catalog. The attack vector is local network access; an attacker must be physically present or otherwise in control of the local network to exploit the flaw. Once accessed, the device may be compromised through authentication bypass, leading to possible data theft or further lateral movement.