CVE-2025-24245

This issue was addressed by adding a delay between verification code attempts

Critical · published March 31, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
50.6
In the wild
Unconfirmed
What it is

🚨 A malicious app could stroll right in and snag your saved passwords without breaking a sweat! 🔥 Imagine leaving your diary in a café for just anyone to peek at. The lack of a security delay is like someone being able to flip through your diary pages as fast as they can, uncovering all your secrets before you can even stop them! This means that an attacker could potentially gather all of your stored passwords, leading to account takeovers and unauthorized access to your sensitive information. It’s absolutely devastating! If you’ve been using macOS before version 15.4, this flaw could leave your data exposed.

Put simply

Imagine leaving your diary in a café for just anyone to peek at. The lack of a security delay is like someone being able to flip through your diary pages as fast as they can, uncovering all your secrets before you can even stop them! This vulnerability allows a malicious app to access users' saved passwords through a timing attack, taking advantage of the rapid verification code attempts without a delay in between.

What to do

This means that an attacker could potentially gather all of your stored passwords, leading to account takeovers and unauthorized access to your sensitive information. It’s absolutely devastating! If you’ve been using macOS before version 15.4, this flaw could leave your data exposed. Immediately update your macOS to Sequoia version 15.4 or later to secure your passwords. Additionally, review your app permissions to ensure only trusted applications have access to sensitive information. You've got this! Follow these steps, and you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00651 · 50.6th percentile
Published
2025-03-31T22:23Z
EPSS history
Timeline
  • 31 MAR 22:23Z
    This issue was addressed by adding a delay between verification code attempts
    cvelistv5