Apple Find My Backend Device Enumeration and Removal Vulnerability

Executive Summary

CVE-2025-68640 is a flaw in Apple's Find My backend service that lets an attacker with a valid Private Endpoint Token (PET) and Apple ID enumerate and remove devices from an iCloud account without triggering two-factor authentication or verifying device ownership. The attacker can list devices and remove offline ones silently, bypassing iCloud Lock protection.

Useful 0 Not Useful 0

Detection Guidance

Detection requires monitoring network traffic for unusual requests to Apple's Find My backend endpoints (/initClient, /authForUserDevice, /remove). Check logs for repeated failed authentication attempts or unauthorized device removal requests. Use network monitoring tools to inspect traffic to fmipmobile.icloud.com for suspicious PET token usage.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to remove your devices from your iCloud account without your knowledge or consent. If your device is offline, the attacker can bypass Activation Lock and remove it, potentially gaining control over your device or preventing you from locating or using it.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized access to and removal of devices linked to an Apple ID account. GDPR requires strict data protection and user control over personal data, while HIPAA mandates safeguards for protected health information. Unauthorized device removal may violate these standards by compromising data integrity and user access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Enable multi-factor authentication (MFA) for your Apple ID. Review and revoke any suspicious sessions or devices linked to your account. Update your iOS devices to the latest version to ensure the patch is applied. Monitor account activity for unauthorized changes.

Useful 0 Not Useful 0