Apple iOS CVE-2026-20683

Requires a malicious or compromised app already installed and running on the victim's Apple device (AV:L - local, not remote/network). The user must actively use the Sign In With Apple authentication flow for the app to abuse it (UI:R). No prior privileges or authentication by the attacker's app are needed beyond normal app installation (PR:N). Exploitation is limited to unpatched versions (below iOS/iPadOS 27, macOS 15.8/26.7/Golden Gate 27, visionOS 27); the mandatory local app presence and required user sign-in interaction significantly limit scalability and make mass, unattended exploitation impractical.

This is a moderate-priority, real-but-locally-scoped authentication flaw, not a critical remote threat. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N = 7.1) is internally consistent with the description: exploitation is LOCAL (AV:L) - a malicious app already present on the device - and requires user interaction (UI:R), namely the victim engaging with the Sign In With Apple flow. All corroborating signals point to low real-world exploitation pressure: EPSS is only 0.24% (15th percentile), there is no CISA KEV listing, and no public exploit code is identified. These signals align rather than conflict - a low EPSS and absent KEV are consistent with a bug that demands local app presence plus user action, which resists mass automation. The high confidentiality/integrity impact (Apple Account access/takeover) is what justifies the 7.1 despite the local vector. No key data is contradictory; the main caveat is that the mechanism ('improved state management') is deliberately vague per Apple's standard advisory style, so the exact abuse primitive is not disclosed.

A user installs a malicious or compromised app from a third-party source (or a trojanized legitimate app). When the user later invokes Sign In With Apple, the app abuses a state-management weakness in the authentication flow to hijack or reuse the resulting authenticated session and gain access to the user's Apple Account. No public proof-of-concept exists, and exploitation requires the victim to actually go through the sign-in flow (UI:R).