CVE-2026-84490
Analyzed Analyzed - Analysis Complete

Digital ID Authentication Bypass in iOS and iPadOS

Publication date: 2026-10-20

Last updated on: 2026-11-03

Assigner: Apple Inc.

Description
This issue was addressed through improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker with physical access to a locked device may be able to bypass Digital ID authentication when iPhone Mirroring is active.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-11-03
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-84490
EUVD
EUVD-2026-104703

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apple ipados to 27.0 (exc)
apple iphone_os to 27.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an attacker with physical access to a locked device to bypass Digital ID authentication if iPhone Mirroring is active. It was fixed in iOS 27 and iPadOS 27 through improved state management.

Detection Guidance

This vulnerability requires physical access to a locked device with iPhone Mirroring active. Detection is not possible via network commands as it involves local device state management. Ensure devices are updated to iOS 27 or iPadOS 27 to mitigate the risk.

Impact Analysis

An attacker could gain unauthorized access to a locked device, potentially accessing sensitive data or performing actions without proper authentication.

Compliance Impact

The provided CVE data does not mention compliance with GDPR, HIPAA, or other standards. The vulnerability involves bypassing authentication on a locked device with physical access when iPhone Mirroring is active, but no direct impact on regulatory compliance is described.

Mitigation Strategies

Update to iOS 27 or iPadOS 27 to address the vulnerability. Ensure iPhone Mirroring is disabled when the device is locked to prevent potential bypass of Digital ID authentication.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84490. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...