CVE-2025-24180

Description

The issue was addressed with improved input validation. This issue is fixed in Safari 18.4, visionOS 2.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A malicious website may be able to claim WebAuthn credentials from another website that shares a registrable suffix.

References

https://www.bleepingcomputer.com/news/security/apple-backports-zero-day-patches-to-older-iphones-and-macs/

https://support.apple.com/en-us/122379

https://support.apple.com/en-us/122378

https://support.apple.com/en-us/122373

https://support.apple.com/en-us/122371

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3