Apple sign-in has a zero-day vulnerability, Indian programmer discovers

A ‘zero-day’ vulnerability was detected in Apple’s ‘sign-in with Apple’ account authentication in April by an Indian security programmer Bhavuk Jain who claims to have been paid $100,000 (approx Rs7.5 million) by Apple under their Apple Security Bounty program.

The vulnerability is believed to affect third-party apps which were using Apple’s authentication but didn’t deploy any additional security measures of their own. If exploited, it could have allowed attackers to take full control over user accounts on third party apps.

Mint could not secure a confirmation on this from Apple. According to Jain, after the matter was brought to their attention, Apple conducted an investigation of their logs and found the vulnerability had not been misused and no accounts had been compromised due to it.