This vulnerability permits an attacker to trigger the system's password autofill even after unauthenticated or failed login attempts, enabling the retrieval of stored credentials. The weakness arises from improper state management during authentication and is classified as CWE‑287. The potential impact is exposure of usernames and passwords, compromising confidentiality and allowing subsequent unauthorized access.

Affected vendors include Apple, with products iOS, iPadOS, macOS, visionOS, and watchOS. Versions earlier than iOS 18.4, iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, and watchOS 11.4 are vulnerable. The issue is fixed in these publicly released versions.

The CVSS score of 9.8 indicates critical severity. EPSS below 1 % suggests low exploitation probability, and it is not listed in the CISA KEV catalog. Exploitation requires the attacker to be able to initiate a login attempt on the device; the attacker can then observe that the password field is auto‑filled with the target’s credentials, enabling credential theft. The attack vector is likely local, inferred from the description.