The vulnerability stems from a missing delay enforcement between verification code attempts in macOS Keychain, which fails to restrict rapid successive queries. Because proper authorization checks (CWE‑862) are not applied, a malicious program can read a user’s stored passwords without any additional authentication. The description explicitly states that a malicious app may access saved passwords, and based on this, it is inferred that the lack of a delay permits repeated keychain reads that expose sensitive credentials.

Apple macOS, all releases older than Sequoia 15.4. The fix is delivered in Sequoia 15.4; any macOS version that has not received this update remains vulnerable.

The CVSS score of 9.8 places the flaw in the Critical range, while the EPSS score of less than 1% indicates a low current likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need local execution of a malicious application, as implied by the requirement for a malicious app to access Keychain data. Once executed, the app can read stored passwords without authentication, underscoring the importance of applying the vendor patch.