CVE-2024-23255 is an authentication bypass vulnerability affecting Apple iOS and iPadOS devices. It allowed unauthorized viewing of photos stored in the Hidden Photos Album without requiring user authentication. Apple resolved this issue by improving state management mechanisms within the affected operating systems. The fix is included in iOS 17.4 and iPadOS 17.4 releases. The vulnerability is rated critical with a CVSS 3.1 base score of 9.1, reflecting its network attack vector, low attack complexity, no privileges required, and no user interaction needed, with high confidentiality and integrity impacts. This vulnerability is part of a broader set of security fixes released by Apple in March 2024.

An attacker could view photos in the Hidden Photos Album on affected iOS and iPadOS devices without authenticating, compromising user privacy and confidentiality of sensitive images. The vulnerability does not require privileges or user interaction, increasing the risk of unauthorized data exposure. There are no known exploits in the wild at the time of disclosure. The issue could lead to significant privacy violations if exploited.

Apple has released official patches addressing this vulnerability in iOS 17.4 and iPadOS 17.4. Users and administrators should apply these updates promptly to remediate the issue. Since this is a client-side vulnerability in device operating systems, updating to the fixed versions is the primary and recommended mitigation. No additional vendor advisories indicate alternative mitigations or temporary workarounds.