CVE-2025-43428
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
A configuration issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Photos in the Hidden Photos Album may be viewed without authentication.
Analysis
Unauthenticated access to Hidden Photos Album in Apple iOS, iPadOS, macOS, and visionOS allows remote attackers to view protected photos without authentication due to a configuration flaw. Fixed in iOS/iPadOS 26.2, macOS Tahoe 26.2, and visionOS 26.2. CVSS 9.8 (Critical) reflects network-based unauthenticated access, though EPSS of 0.13% (32nd percentile) suggests low observed exploitation probability. No public exploit identified at time of analysis, and not listed in CISA KEV. This represents a privacy-critical authentication bypass affecting Apple's Photos app across all major platforms.
Technical Context
This vulnerability stems from CWE-306 (Missing Authentication for Critical Function), specifically a misconfiguration in Apple's Photos application framework that failed to enforce authentication checks when accessing the Hidden Photos Album. The Hidden Photos Album is a privacy feature designed to protect sensitive images from casual viewing, requiring Face ID, Touch ID, or device passcode authentication. The configuration flaw allowed the authentication gate to be bypassed entirely, enabling network-accessible exposure of what users assumed were protected assets. Affected products span Apple's entire ecosystem: iOS (iPhone OS) versions prior to 26.2, iPadOS prior to 26.2, macOS prior to Tahoe 26.2, and visionOS prior to 26.2, as identified by CPE strings for apple:iphone_os, apple:ipados, apple:macos, and apple:visionos. The fix involved implementing additional configuration restrictions to properly enforce authentication requirements before album access.
Affected Products
This vulnerability affects Apple iOS (iPhone OS) versions prior to 26.2, iPadOS versions prior to 26.2, macOS versions prior to Tahoe 26.2, and visionOS versions prior to 26.2. All Apple mobile devices running iOS/iPadOS, Mac computers running macOS, and Apple Vision Pro devices running visionOS are impacted if not updated to the specified versions. The vulnerability specifically impacts the Photos application's Hidden Photos Album feature across these platforms. Vendor advisories are available at https://support.apple.com/en-us/125884 (iOS/iPadOS), https://support.apple.com/en-us/125886 (macOS), and https://support.apple.com/en-us/125891 (visionOS), providing detailed affected version information and update instructions.
Remediation
Vendor-released patches are available: immediately update to iOS 26.2 and iPadOS 26.2 for mobile devices, macOS Tahoe 26.2 for Mac computers, and visionOS 26.2 for Apple Vision Pro devices. These updates address the configuration issue by implementing additional authentication restrictions on Hidden Photos Album access. Updates can be installed through System Settings > General > Software Update on iOS/iPadOS, System Settings > General > Software Update on macOS, or Settings > General > Software Update on visionOS. No workarounds are available; patching is the only remediation path. Organizations managing Apple devices through MDM solutions should deploy these updates as high-priority to protect user privacy. Detailed installation instructions and security content information are available in Apple's support bulletins at https://support.apple.com/en-us/125884, https://support.apple.com/en-us/125886, and https://support.apple.com/en-us/125891.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today