Apple Music Classical for Android versions prior to 2.3 contain a flaw that may cause the application to leak a user's credentials unexpectedly. The vulnerability is described as an information disclosure flaw, allowing an attacker to gain unauthorized access to stored authentication data. Crucially, the disclosed data could be used to impersonate the user or gain further access to other services the credentials authorize.

The affected product is Apple Music Classical running on Android devices. Only versions before 2.3 are vulnerable; the fix is contained in Apple Music Classical 2.3 and later. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog and the EPSS indicates a very low, but non‑zero, exploitation probability.

The CVSS score of 6.2 indicates moderate severity. The very low EPSS (<1%) suggests that exploitation is unlikely under normal conditions, yet the possibility exists for targeted attacks. As no remedy or workaround is advertised by Apple, the primary mitigation is to upgrade to a fixed version. The absence from KEV indicates no known active exploitation, but caution is advised as credential leakage can enable further attacks.