CVE-2025-24180

No fix known EPSS 1%CVSS 8.1

The issue was addressed with improved input validation. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. A malicious website may be able to claim WebAuthn credentials from another website that shares a registrable suffix.

Published 2025-03-31 · CVE record · OSV

Products: apple safari, Apple iOS and iPadOS, Apple macOS, Apple visionOS, Apple watchOS