CVE-2025-30430

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-30430", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2025-03-22T00:04:43.716Z", "datePublished": "2025-03-31T22:23:50.933Z", "dateUpdated": "2026-04-02T18:22:39.317Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "Password autofill may fill in passwords after failing authentication"}]}], "affected": [{"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"version": "0", "status": "affected", "lessThan": "18.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"version": "0", "status": "affected", "lessThan": "15.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "visionOS", "versions": [{"version": "0", "status": "affected", "lessThan": "2.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "watchOS", "versions": [{"version": "0", "status": "affected", "lessThan": "11.4", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. Password autofill may fill in passwords after failing authentication."}], "references": [{"url": "https://support.apple.com/en-us/122371"}, {"url": "https://support.apple.com/en-us/122373"}, {"url": "https://support.apple.com/en-us/122376"}, {"url": "https://support.apple.com/en-us/122378"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-04-02T18:22:39.317Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-287", "lang": "en", "description": "CWE-287 Improper Authentication"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-01T19:37:06.283551Z", "id": "CVE-2025-30430", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-01T19:39:13.322Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2025/Apr/13"}, {"url": "http://seclists.org/fulldisclosure/2025/Apr/8"}, {"url": "http://seclists.org/fulldisclosure/2025/Apr/4"}, {"url": "http://seclists.org/fulldisclosure/2025/Apr/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:14:12.136Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-30430", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2025-03-22T00:04:43.716Z", "datePublished": "2025-03-31T22:23:50.933Z", "dateUpdated": "2025-04-01T19:39:13.322Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "Password autofill may fill in passwords after failing authentication"}]}], "affected": [{"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"version": "unspecified", "status": "affected", "lessThan": "18.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"version": "unspecified", "status": "affected", "lessThan": "15.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "visionOS", "versions": [{"version": "unspecified", "status": "affected", "lessThan": "2.4", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "This issue was addressed through improved state management. This issue is fixed in visionOS 2.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. Password autofill may fill in passwords after failing authentication."}], "references": [{"url": "https://support.apple.com/en-us/122371"}, {"url": "https://support.apple.com/en-us/122373"}, {"url": "https://support.apple.com/en-us/122378"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2025-03-31T22:23:50.933Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-30430", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-01T19:37:06.283551Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-01T19:38:55.359Z"}}]}}

{"affected": [{"affectedData": [{"product": "iOS and iPadOS", "vendor": "Apple", "versions": [{"lessThan": "18.4", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "macOS", "vendor": "Apple", "versions": [{"lessThan": "15.4", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "visionOS", "vendor": "Apple", "versions": [{"lessThan": "2.4", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "watchOS", "vendor": "Apple", "versions": [{"lessThan": "11.4", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "product-security@apple.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B3450F7-7B4A-46CE-A6E0-BBE6569F2EBF", "versionEndExcluding": "18.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "0D9C73F9-FEF4-4FC1-B83D-56566AD35990", "versionEndExcluding": "18.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "1320B815-0457-4276-83B9-AFAFDAF17EDA", "versionEndExcluding": "15.4", "versionStartIncluding": "15.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*", "matchCriteriaId": "E82603D7-A630-4B9B-9C51-880667F05EC7", "versionEndExcluding": "2.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. Password autofill may fill in passwords after failing authentication."}, {"lang": "es", "value": "Este problema se solucion\u00f3 mejorando la gesti\u00f3n del estado. Este problema se solucion\u00f3 en visionOS 2.4, iOS 18.4, iPadOS 18.4 y macOS Sequoia 15.4. El autocompletado de contrase\u00f1as puede completar las contrase\u00f1as despu\u00e9s de un error de autenticaci\u00f3n."}], "id": "CVE-2025-30430", "lastModified": "2026-06-17T09:08:42.767", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-30430", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-04-01T19:37:06.283551Z", "version": "2.0.3"}}]}, "published": "2025-03-31T23:15:25.313", "references": [{"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/122371"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/122373"}, {"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/122376"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/122378"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2025/Apr/12"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2025/Apr/13"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2025/Apr/4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2025/Apr/8"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T02:38:12.135358+00:00", "value": {"mitigation_remediation": ["Update the device to iOS\u202f18.4, iPadOS\u202f18.4, macOS\u202fSequoia\u202f15.4, visionOS\u202f2.4, or watchOS\u202f11.4, whichever applies; the update contains the official fix.", "If an update is not immediately available, temporarily disable the password autofill feature to prevent unintended credential disclosure.", "Configure device lock policies and enable multi\u2011factor authentication to reduce the impact of any credential theft."], "summary": {"action": "Apply patches", "impact": "Authentication bypass via password autofill after failed login"}, "threat_synthesis": {"affected_systems": "Affected vendors include Apple, with products iOS, iPadOS, macOS, visionOS, and watchOS. Versions earlier than iOS\u202f18.4, iPadOS\u202f18.4, macOS Sequoia\u202f15.4, visionOS\u202f2.4, and watchOS\u202f11.4 are vulnerable. The issue is fixed in these publicly released versions.", "description_and_impact": "This vulnerability permits an attacker to trigger the system's password autofill even after unauthenticated or failed login attempts, enabling the retrieval of stored credentials. The weakness arises from improper state management during authentication and is classified as CWE\u2011287. The potential impact is exposure of usernames and passwords, compromising confidentiality and allowing subsequent unauthorized access.", "risk_and_exploitability": "The CVSS score of 9.8 indicates critical severity. EPSS below 1\u202f% suggests low exploitation probability, and it is not listed in the CISA KEV catalog. Exploitation requires the attacker to be able to initiate a login attempt on the device; the attacker can then observe that the password field is auto\u2011filled with the target\u2019s credentials, enabling credential theft. The attack vector is likely local, inferred from the description."}}}}, "created": "2026-04-28T02:45:11.081239+00:00", "title": "Authentication bypass allowing password autofill after failed login", "updated": "2026-04-28T02:45:11.081250+00:00", "vendors": []}