State issues in macOS - CVE-2026-20683
Published: September 14, 2026
Vulnerability identifier: #VU149723
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-20683
CWE-ID: CWE-371
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in Apple Account. A local application can use the Sign In With Apple authentication flow to access the user's Apple Account.
Affected software
macOS
visionOS
Apple iOS
iPadOS
visionOS
Apple iOS
iPadOS
How to mitigate CVE-2026-20683
Install update from vendor's website.
macOS - addressed in versions 26.7 25G229, 15.8 24H23, 27.0 26A428
visionOS - update to 27.0
Apple iOS - addressed in versions 27.0 24A427, 27.0 24A437
iPadOS - update to 27.0 24A437
visionOS - update to 27.0
Apple iOS - addressed in versions 27.0 24A427, 27.0 24A437
iPadOS - update to 27.0 24A437