The vulnerability is a graphical user interface flaw that may allow password fields to be unintentionally exposed, potentially revealing user credentials to local processes or a malicious observer. The issue was resolved in iOS 26 and iPadOS 26, and Apple marked it as an information‑disclosure flaw with a CVSS score of 5.5, indicating moderate confidentiality impact.

The flaw affects all Apple iOS and iPadOS devices running a version older than 26. Users whose devices have not been upgraded remain susceptible, while devices updated to iOS 26 or iPadOS 26 incorporate the UI fix that prevents inadvertent password exposure.

The EPSS score is less than 1%, and the vulnerability is not included in the CISA KEV catalog, suggesting a low likelihood of large‑scale exploitation. Nevertheless, the disclosure of passwords presents a significant privacy risk, especially if an attacker can manipulate the UI or capture the screen. The CVSS of 5.5 reflects a moderate risk that should prompt prompt remediation once the update becomes available.