CVE-2025-68640

MEDIUM

Apple Find My Backend <= 2025-12-17 - Unauthenticated Device Enumeration and Removal via Valid PET

Title source: llm

Description

The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET (Private Endpoint Token) to enumerate devices and remove offline devices from an Apple ID account without triggering two-factor authentication or ownership verification. This may result in unauthorized removal of devices associated with the account.

References (2)

Core 2

Core References

https://github.com/akadriu98/OE1102082402813

View Writeup ZIP pw:eip

https://gist.github.com/akadriu98/63123df9e7e3f154b3a0d54df178bb42

Scores

CVSS v3 5.3

EPSS 0.0028

EPSS Percentile 20.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-287 CWE-306

Status published

Published Jul 21, 2026

Tracked Since Jul 21, 2026