CVE-2025-24180

Details

The issue was addressed with improved input validation. This issue is fixed in Safari 18.4, visionOS 2.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A malicious website may be able to claim WebAuthn credentials from another website that shares a registrable suffix.

Affected Packages

macOS:15macOS

Fixed in:

15.4

References

WEBhttp://seclists.org/fulldisclosure/2025/Apr/12 WEBhttp://seclists.org/fulldisclosure/2025/Apr/13 WEBhttp://seclists.org/fulldisclosure/2025/Apr/2 WEBhttp://seclists.org/fulldisclosure/2025/Apr/4 WEBhttp://seclists.org/fulldisclosure/2025/Apr/8 WEBhttps://support.apple.com/en-us/122371 WEBhttps://support.apple.com/en-us/122373 WEBhttps://support.apple.com/en-us/122378 WEBhttps://support.apple.com/en-us/122379 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2025-24180

CVE-2025-24180

Details

Affected Packages

References

CVSS Analysis

Ecosystems

Timeline