Description
The issue was addressed with improved input validation. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. A malicious website may be able to claim WebAuthn credentials from another website that shares a registrable suffix.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apple | Safari | < 18.4 | 18.4 |
| Apple | iOS and iPadOS | < 18.4 | 18.4 |
| Apple | macOS | < 15.4 | 15.4 |
| Apple | visionOS | < 2.4 | 2.4 |
| Apple | watchOS | < 11.4 | 11.4 |
Advisories 5
- WID-SEC-2025-0668 Apple macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 11, 2026
- WID-SEC-2025-0663 Apple iOS und iPadOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 11, 2025
- NCSC-2025-0103 Kwetsbaarheden verholpen in Apple iOS en iPadOS NCSC-NL (Netherlands) · Apr 1, 2025
- NCSC-2025-0102 Kwetsbaarheden verholpen in Apple macOS NCSC-NL (Netherlands) · Apr 1, 2025
- WID-SEC-2025-0667 Apple Safari: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 31, 2025