The vulnerability in ueberauth_apple exemplifies a CWE‑290 authentication bypass flaw, allowing an attacker to replay an Apple‑signed ID token that carries the victim’s unique sub claim. The strategy verifies only the JWT signature but neglects to validate issuer, audience, expiration, and issued‑at claims, enabling replay of stolen or expired tokens indefinitely and full access to the application.

The affected component is the ueberauth_apple strategy module used by Elixir and Phoenix web applications for Apple sign‑in. Versions from 0.1.0 up to but not including 0.6.2 are vulnerable. Both listings for ueberauth:ueberauth_apple in the CNA data refer to the same library; any application that integrates this component is exposed.

The CVSS score of 9.1 indicates a critical flaw, while the EPSS score of less than 1% suggests low recent exploitation activity. However, because the vulnerability permits replay of any Apple‑signed token without claim checks, it can be exploited by attackers who capture or otherwise obtain a token containing a victim’s sub claim. The absence of an exp check makes stolen tokens usable indefinitely, and the missing aud check enables cross‑application takeover among clients sharing an Apple developer team. The issue is not listed in CISA’s KEV catalog, but the impact on user credentials and potential for full account takeover warrants immediate remediation.