The Apple Find My backend service, as implemented up to 2025‑12‑17, contains an authentication bypass weakness (CWE‑287) and a missing authorization check (CWE‑306). An attacker who has a valid Private Endpoint Token (PET) can enumerate all devices associated with an Apple ID and remove offline devices. Because this action bypasses two‑factor authentication and ownership verification, the attacker can erase devices from an account without the user’s knowledge or consent, potentially compromising account recovery and device management.

Affected systems are the Apple Find My backend component used by all Apple ID accounts that rely on PET authentication. No specific product version numbers are listed, but the vulnerability applies to all releases prior to 2025‑12‑17 as noted by the data.

The CVSS score of 5.3 indicates a moderate impact, while an EPSS score of less than 1% suggests that widespread exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker already possess a valid PET, implying a token compromise or leaking scenario. Once in possession, the attacker can directly interact with the backend and perform removal actions without additional privileges or further authentication steps.