A logging flaw allows an application to read usernames and website names stored in a user’s iCloud Keychain, resulting in disclosure of confidential credentials. The vulnerability stems from insufficient redaction of sensitive data prior to logging, a weakness categorized as CWE-532. The exposed data may let an attacker glean personal login information and browsing habits, compromising user privacy and potentially facilitating credential theft.

Apple devices running iPadOS 17.7.7 or earlier, macOS Sequoia 15.5 or earlier, macOS Sonoma 14.7.6 or earlier, or macOS Ventura 13.7.6 or earlier are impacted. The issue has been resolved in the cited OS releases.

The CVSS score of 7.6 indicates a high severity, whereas the EPSS score of < 1% suggests a low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves a malicious or compromised third‑party app that can read the system logs where the usernames and websites were inadvertently recorded. The adversary would then extract the exposed data, enabling credential theft or enumeration of services accessed by the user.