CVE-2025-68640

Name of the Vulnerable Software and Affected Versions Apple Find My backend service versions prior to 2025-12-18

Description The backend service allows an attacker with a valid Private Endpoint Token (PET) to enumerate devices and remove offline devices from an Apple ID account. This process bypasses two-factor authentication and ownership verification, potentially leading to the unauthorized removal of devices associated with the account.

Recommendations Update the Apple Find My backend service to a version released after 2025-12-17.