The vulnerability is an authentication issue that allows an attacker to impersonate other users by exploiting improper state management during authentication. This flaw means an attacker could gain access to another user's account or session without proper credentials, leading to unauthorized access to personal information, system resources, or privileged functions. The primary weakness is an improper authentication flaw (CWE‑285, CWE‑287), which can undermine confidentiality and integrity.

Affected systems include Apple macOS. In particular, macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 are vulnerable. All current macOS versions prior to these patch levels are impacted.

The CVSS score of 9.1 indicates a critical severity, while the EPSS of < 1% suggests a low probability of exploitation, and the vulnerability is not listed in CISA KEV. The vulnerability was fixed by Apple, so the risk is mitigated only when a system is updated. The likely attack vector is the authentication flow of macOS login, inferred from the description of state management, meaning remote or local authentication can be subverted.