Apple Find My
CVE-2025-68640
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
PET constitutes a credential requiring PR:L; offline device removal is an integrity impact making I:N in the provided vector incorrect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET (Private Endpoint Token) to enumerate devices and remove offline devices from an Apple ID account without triggering two-factor authentication or ownership verification. This may result in unauthorized removal of devices associated with the account.
AnalysisAI
Apple's Find My backend service allows an attacker who holds a valid PET (Private Endpoint Token) to enumerate devices on an Apple ID account and silently remove offline devices without triggering two-factor authentication or ownership verification - a CWE-287 Improper Authentication flaw. The vulnerability affects the service through at least December 17, 2025, with researcher-published proof-of-concept code on GitHub demonstrating the technique. EPSS sits at 0.19% (9th percentile) and the vulnerability is not listed in CISA KEV, pointing toward targeted rather than opportunistic exploitation; however, the account-manipulation impact makes it meaningful for high-value Apple ID targets.
Technical ContextAI
The Apple Find My backend is Apple's cloud infrastructure powering device location and the crowdsourced Find My network used by hundreds of millions of Apple devices and third-party accessories. A PET (Private Endpoint Token) is a credential presented to private API endpoints of the service to authenticate device-related requests. The root cause is CWE-287 (Improper Authentication): the backend accepts a valid PET as sufficient authorization for sensitive account operations - device enumeration and offline device removal - without escalating to two-factor authentication or verifying that the presenter is the legitimate account owner. No formal CPE identifier was assigned by NVD (cpe:2.3:a:n/a:n/a), indicating the product scope was not catalogued at time of publication. The referenced GitHub repository (akadriu98/OE1102082402813) constitutes the primary technical disclosure.
RemediationAI
No vendor-released patch has been identified at time of analysis, and no official Apple advisory is available in the provided references. Account holders should immediately audit devices listed at appleid.apple.com and investigate any unexpected removals. As a compensating control, users should review recent account activity for unauthorized API interactions and enable any available account-change notification features within the Apple ID portal. Security teams managing Apple device fleets (MDM environments) should monitor for unexpected device disenrollment events, which may indicate exploitation. No documented mechanism for PET invalidation or rotation has been confirmed in available data, so the primary defense remains detecting anomalous device removal events post-facto. Given the lack of a vendor advisory and the n/a CPE assignment, organizations should treat the researcher disclosure at https://github.com/akadriu98/OE1102082402813 as the authoritative technical reference until Apple releases an official statement.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today