This vulnerability involves a permissions issue in the password autofill mechanism of Apple iOS and iPadOS. Specifically, the autofill feature may incorrectly provide passwords after an authentication failure, potentially exposing sensitive credentials. Apple resolved this by removing the vulnerable code and implementing additional verification checks. The fix is included in iOS 18 and iPadOS 18 releases. The CVSS v3.1 base score is 9.1, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality and integrity.

Successful exploitation could lead to unauthorized disclosure of user passwords despite failed authentication attempts, compromising user credentials and potentially enabling further unauthorized access. The vulnerability affects confidentiality and integrity but does not impact availability. There are no known exploits in the wild as of the published date.

Apple has fixed this vulnerability in iOS 18 and iPadOS 18. Users and administrators should update their devices to these versions or later to remediate the issue. Since this is not a cloud service, patching the device OS is required. No additional mitigation steps are indicated by the vendor advisory.