A logic flaw in the system validation allows the device to skip the passcode prompt when a backup is restored immediately after a Face ID enrollment. This flaw can lead to unauthorized use of the device if an attacker has physical access. The weakness maps to improper authentication, as it permits access without the expected passcode credential.

Apple’s iOS and iPadOS operating systems are impacted. Prior to version 26.2 of each OS the flaw exists, and the issue is fixed in iOS 26.2 and iPadOS 26.2. Devices running earlier releases without the update could be vulnerable.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1 % suggests a very low probability of exploitation. The vulnerability is not in the CISA KEV catalog. The attack requires physical access to perform a backup restore after a Face ID enrollment, and no remote exploitation surface is described. The likely vector is a local victim device or account that an attacker can manipulate, with remediation available through an OS update.