Description

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to delete credentials stored in Keychain.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-14T21:17:41.353Z",
  "pubdate": "2026-09-14T21:17:41.353Z",
  "executiveSummary": "A critical vulnerability exists within the Keychain management subsystem of Apple operating systems, potentially allowing malicious applications to perform unauthorized deletion of stored sensitive credentials.\nThe vulnerability is classified as an improper authorization or access control flaw, which undermines the integrity and confidentiality of the platform's credential storage mechanism.\nAffected systems include iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27.\nThe risk implication is significant, as an attacker with code execution capabilities within the sandbox could purge credentials, leading to denial-of-service for legitimate application services or facilitating account recovery/takeover scenarios.\nSuccessful exploitation requires the deployment of a malicious application onto the target device; however, the vulnerability allows the application to bypass standard security boundaries governing Keychain access permissions.",
  "technicalDetails": "The vulnerability originates from a logic error in the Keychain interface, which failed to properly enforce access control constraints when processing requests for credential modification or removal.\nIn standard operation, the Keychain service acts as a gated repository where access to specific items is governed by access control lists (ACLs) and entitlements, ensuring that only the originating application or an authorized entity can read or delete sensitive data.\nThe technical root cause involves a flaw in the underlying handler that processes Keychain deletion requests, which did not adequately validate the calling application's security context or authorization tokens against the target item's access requirements.\nAttack flow: An attacker develops a malicious application and successfully executes it on an affected device. The application interacts with the Keychain service API, specifically targeting a key or credential item. Due to the lack of strict privilege verification, the Keychain subsystem incorrectly treats the deletion request as legitimate, allowing the unauthorized deletion of the target entry.\nThis bypasses the platform’s security model, which is designed to prevent cross-application interference with stored credentials.\nThe impact of this vulnerability extends beyond simple data deletion. By clearing credentials, an attacker could force applications to fail, trigger re-authentication loops, or potentially disrupt session persistence, causing significant service degradation.\nThe vulnerability was addressed by the platform vendor by removing the vulnerable code paths that permitted this unauthorized access, thereby restoring the intended security boundary around the Keychain repository.\nThe affected versions include iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27. No authentication or elevated privileges beyond standard application execution were required to trigger this flaw, assuming the underlying logic permitted the unauthorized call."
}