CVE-2026-84490: An attacker with physical access to a locked device may be able to bypass Digital ID authentication when iPhone Mirroring is active in Apple iOS and iPadOS

CVE-2026-84490 describes a security flaw in Apple iOS and iPadOS where an attacker with physical access to a locked device could bypass Digital ID authentication if iPhone Mirroring is enabled. The vulnerability arises from improper state management related to the mirroring feature. Apple has fixed this issue in versions iOS 27 and iPadOS 27 by improving state management to prevent the bypass.

An attacker with physical access to a locked device could bypass Digital ID authentication, potentially gaining unauthorized access to features or data protected by this authentication mechanism when iPhone Mirroring is active. This could lead to unauthorized use or exposure of sensitive information on the device.

This vulnerability is fixed in iOS 27 and iPadOS 27. Users and administrators should update devices to these versions or later to remediate the issue. No additional mitigation steps are indicated beyond applying the official update.