CVE-2025-68640 Overview
CVE-2025-68640 affects the Apple Find My backend service through 2025-12-17. An attacker holding a valid Private Endpoint Token (PET) can enumerate devices tied to an Apple ID and remove offline devices from the account. The backend performs these operations without triggering two-factor authentication or ownership verification. The flaw maps to [CWE-287] Improper Authentication and can lead to unauthorized removal of devices linked to a victim's Apple ID. Public proof-of-concept material has been published on GitHub, though no in-the-wild exploitation has been confirmed.
Critical Impact
An attacker with a valid PET can silently enumerate and unlink offline Apple devices from an Apple ID without prompting the account owner for MFA or ownership confirmation.
Affected Products
- Apple Find My backend service (server-side)
- Apple ID device management flows relying on PET-based authorization
- Offline device unlink endpoints exposed through Find My
Discovery Timeline
- 2026-07-21 - CVE-2025-68640 published to the National Vulnerability Database
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2025-68640
Vulnerability Analysis
The Apple Find My backend accepts a Private Endpoint Token (PET) as sufficient proof to perform sensitive account operations. The service does not require a step-up authentication event, such as two-factor authentication (2FA), before enumerating devices or removing offline ones. Because ownership is not re-verified server-side, possession of a PET is effectively treated as full authorization for these actions.
The vulnerability falls under [CWE-287] Improper Authentication. The attack vector is network-based, requires no user interaction, and no prior privileges beyond obtaining a PET. Confidentiality of device inventory data is exposed through enumeration, and the ability to unlink offline devices introduces an integrity impact on account state, even though the CVSS metric focuses on the disclosure dimension.
Root Cause
The root cause is a missing authorization control on high-impact endpoints. The Find My backend trusts the presence of a valid PET without cross-checking user presence, device trust state, or an active 2FA challenge. Offline devices are especially exposed because they cannot receive push notifications or challenge prompts that might otherwise alert the owner.
Attack Vector
An attacker who obtains a valid PET, for example through token theft, an adjacent compromise, or interception on an attacker-controlled path, submits authenticated requests to the Find My backend. The attacker queries device enumeration endpoints to build an inventory of the target account and then issues removal requests against devices currently marked offline. The victim receives no 2FA prompt and no ownership verification challenge. Technical details and request flows are documented in the GitHub Gist PoC Code and the GitHub Project Repository.
Detection Methods for CVE-2025-68640
Indicators of Compromise
- Unexpected device removal events in Apple ID account activity, particularly for devices that were offline at the time of removal.
- Find My API requests originating from IP addresses or ASNs that do not match the account owner's historical access patterns.
- Absence of a corresponding 2FA challenge event correlated with a sensitive Find My action.
Detection Strategies
- Correlate Apple ID account activity notifications with endpoint telemetry to identify device removals that lack a matching user-initiated action.
- Alert on any Find My device-removal event where the target device has been offline for an extended period.
- Monitor for PET issuance or reuse patterns that deviate from a user's normal session behavior.
Monitoring Recommendations
- Enable and retain Apple ID email and push notifications for device removals and sign-ins across all managed accounts.
- For enterprise deployments, ingest MDM and Apple Business Manager audit logs into a centralized log store and alert on unexpected device deletions.
- Track outbound traffic from user endpoints to identify token exfiltration attempts targeting Apple services.
How to Mitigate CVE-2025-68640
Immediate Actions Required
- Review recent device removal activity on affected Apple IDs and re-register any devices that were unlinked without owner action.
- Rotate Apple ID passwords and re-establish trusted device lists for any account that shows anomalous Find My activity.
- Restrict enterprise access to Apple ID accounts through managed identity workflows and enforce hardware-backed 2FA on all administrator accounts.
Patch Information
No vendor advisory URL is listed in the enriched CVE data at the time of publication. Apple typically remediates backend-only vulnerabilities server-side without a client update. Administrators should monitor Apple's official security release notes for confirmation that the Find My backend has been updated and that PET-based flows now require ownership re-verification.
Workarounds
- Sign out unused or dormant Apple devices to reduce the population of offline targets available to an attacker.
- Audit third-party applications and browser sessions that may hold Apple service tokens and revoke any that are not required.
- Educate users to treat any unexpected Apple ID activity email as an incident and to report it to security operations immediately.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
