Live › vulnerability › CVE-2026-84490
Go to dashboardApple's iOS 27 and iPadOS 27 fix a state management flaw that lets someone with physical access to a locked device bypass Digital ID authentication while iPhone Mirroring is active. The attacker gets to act as the authenticated owner of the Digital ID without knowing the credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Owners of iPhones and iPads running iOS or iPadOS before 27 that use Digital ID and iPhone Mirroring. The exposure needs physical access to a locked device, so managed fleets with strong device controls face lower risk. Devices already on iOS 27 or iPadOS 27 are not affected.
No product ranges from the sources yet.
27 are in scope.27 and iPadOS to 27 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This issue was addressed through improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker with physical access to a locked device may be able to bypass Digital ID authentication when iPhone Mirroring is active.
This page as .md · .json · in your agent: get_signal("CVE-2026-84490")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.