CVE-2024-54530 is a vulnerability in Apple’s password autofill mechanism on iOS and iPadOS where passwords may be autofilled despite failed authentication attempts. This could allow unauthorized access to stored passwords if the autofill triggers incorrectly. Apple fixed this issue by enhancing authentication checks in iOS 18.2, iPadOS 18.2, macOS Sequoia 15.2, visionOS 2.2, and watchOS 11.2. The vulnerability is classified under CWE-863 (Incorrect Authorization). The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impacts.

Successful exploitation of this vulnerability could lead to unauthorized disclosure and modification of sensitive password data due to autofill occurring after failed authentication. This compromises user credentials and potentially allows attackers to gain access to protected accounts or services. The vulnerability does not affect availability. There are no known exploits in the wild currently.

Apple has released official fixes in iOS 18.2, iPadOS 18.2, macOS Sequoia 15.2, visionOS 2.2, and watchOS 11.2 that address this vulnerability by improving authentication checks for password autofill. Users and administrators should apply these updates promptly to mitigate the risk. No additional mitigations are indicated by the vendor advisory.