CVE-2026-20683

CVE-2026-20683 is an authentication weakness in Apple's Sign In With Apple flow caused by improper state management, allowing an app on the device to abuse the authentication flow and gain access to the user's Apple Account. Exploitation requires a malicious or vulnerable app already present on an affected iPhone, iPad, Mac, or Vision Pro; no separate network exposure is needed. A successful attacker could potentially access the victim's Apple Account, which typically gates iCloud data, purchases, and linked services. The flaw affects devices running iOS/iPadOS versions prior to 27, macOS prior to Sequoia 15.8 / Tahoe 26.7 / Golden Gate 27, and visionOS prior to 27, all fixed in Apple's September 2025 release wave. No public proof-of-concept or in-the-wild exploitation has been reported, and the issue is not on the CISA KEV list.

What to do: Update all Apple devices immediately to iOS 27 / iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, or visionOS 27, and use MDM or Apple's rapid security response tooling to force fleet-wide patching. Review the list of apps authorized to use Sign In With Apple (Settings > Apple Account > Sign-In and Security) and revoke access for any untrusted or unknown third-party apps. Audit enterprise app inventories for apps that initiate Sign In With Apple flows, since a malicious app on the device is the delivery vector.