CVE-2025-68640 Missing authorization in n/a
Attackers with valid tokens can remove devices from Apple IDs without authentication, bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-68640?
CVE-2025-68640 is a medium-severity missing authorization vulnerability in n/a, published on 21 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET (Private Endpoint Token) to enumerate devices and remove offline devices from an Apple ID account without triggering two-factor authentication or ownership verification. This may result in unauthorized removal of devices associated with the account.
Which versions are affected by CVE-2025-68640?
How do I fix CVE-2025-68640?
No fix has been published for CVE-2025-68640 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-68640 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-68640 exists.
Sources
Also known as GHSA-ch3c-prwc-w55h.