An authentication issue related to state management was identified, allowing an attacker who has physical access to a locked Apple macOS device to view sensitive user information. The vulnerability arises from a flaw in how the system tracks authentication state, enabling bypass of expected security checks. While the flaw does not provide full control or remote code execution, it compromises privacy by exposing data that should remain protected while the device is locked.

Apple macOS installations that are not running macOS Sequoia 15.4 or newer, macOS Sonoma 14.7.5 or newer, and macOS Ventura 13.7.5 or newer are susceptible to this authentication bypass. Users of older macOS releases should verify their hardware and software versions against these supported releases.

The CVSS score of 4.6 indicates low severity, and an EPSS score of less than 1% highlights a very low probability of exploitation at the time of analysis. Because the vulnerability requires physical access to a locked device, the attack surface is limited to scenarios where an adversary can physically reach the target. This vulnerability is not listed in the CISA KEV catalog, and no public exploits are currently documented. Official guidance recommends upgrading to the patched macOS releases to mitigate the weakness.