An Indian developer has recently discovered a significant bug on Apple Sign-In on third-party apps. This bug could have potentially leaked many users’ information but is fixed by the company.
Apple does not confirm the news, but the developer known as Bhavuk Jain posted on his website about the flaw he discovered and receive a hefty amount from the company itself. The 27-year-old is from New Delhi, India, and has been compensated for the Finding in Apple’s server.
Well, not getting into many technical terms, this flaw in the Apple Sign-in can be exploited via third-party apps, and hackers could have easily gained access to third-party accounts of millions of people. Still, thanks to the Developer, it’s now fixed by the company. Let’s see what the bug exactly looks like
Below is the configuration of how the Apple Sign-in on the third-party works.
- Advertisement -
Apple uses JWT(JSON Web Tokens) or a code. While authorizing a third-party app, Apple gives you a notification if you want to share your e-mail with the third-party app or not. After you do, Apple creates a JWT containing the E-Mail ID which verified with Apple’s public key, will log in to the third-party app.
This is the basis of how the Apple Sign-in works on third-party apps. You might be wondering how is this a bug? Well, Jain found out that you could forge a JWT for any email and request access using the Apple key for permission, and the server would grant it. Yes basically anyone could easily get your third-party account access which is integrated with Apple’s Sign-in feature.
This vulnerability in Apple Sign-In could’ve resulted in losing your account forever and damaged it on a long term basis. Many of the developers have integrated Apple Sign-In into their apps to make the lives of people easier and allowing them a smooth sign-in experience. Some of the most commonly used apps like Spotify, Airbnb, and GIPHY use this feature which was vulnerable to these attacks.
Jain also said that Apple did a log check and did not find any information or data that was leaked out, so users are safe now. No account has been compromised due to this bug. The amount by the Apple rewarded was 75lakh INR ($100,000). This proves how the Internet has a vast area of opportunities for people with skills and a keen eye for everything.
Also Read HTC U Ear earbuds looks like cloned Apple AirPods
