This vulnerability (CVE-2024-54542) involves an authentication bypass in Apple Safari's Private Browsing mode, where private tabs could be accessed without requiring user authentication. The issue was resolved by Apple in Safari 18.2, iOS 18.2, iPadOS 18.2, macOS Sequoia 15.2, and watchOS 11.2 through improved state management. The CVSS 3.1 base score is 9.1, reflecting network attack vector, no privileges required, no user interaction, and high confidentiality and availability impacts. The vulnerability is categorized under CWE-862 (Missing Authorization). No public exploits have been reported.

Successful exploitation of this vulnerability could allow unauthorized access to Private Browsing tabs, compromising user privacy and potentially exposing sensitive browsing data. The impact includes a high confidentiality breach and denial of service to the affected browsing session. There is no indication of integrity impact. No known active exploitation has been reported.

Apple has released official fixes in Safari 18.2 and corresponding OS versions (iOS 18.2, iPadOS 18.2, macOS Sequoia 15.2, watchOS 11.2). Users and administrators should apply these updates promptly to remediate the vulnerability. Patch status is confirmed fixed in these versions. No additional mitigation steps are indicated by the vendor advisory.