Root cause
Token issuance failed to maintain a trustworthy relationship between the authenticated identity and identity claims used by relying applications. Cryptographic validity alone did not establish correct claim ownership.
Demonstrated impact
Potential takeover of third-party application accounts using the integration without additional safeguards. Named third-party applications were not tested by the researcher.
Lessons for review
- Validate identity-claim ownership in addition to token cryptographic validity.
- Document relying-party assumptions and additional authentication safeguards.
Award and evidence
The researcher explicitly reports being paid $100,000 but supplies no currency code or exact settlement date. USD is contextually inferred from Apple's May 2019 iOS Security guide (currency-context), whose Apple Security Bounty table on printed page 87 labels maximum payments in USD. This source describes the then-existing iOS program and predates the May 2020 disclosure by about one year. It supplies denomination context only and does not independently establish this individual payment's currency, amount, category or settlement.
Primary researcher payment statement reread; Apple's May 2019 iOS Security guide reviewed for earlier program-level denomination context only. Individual payment attribution remains researcher-reported. No target testing performed.
- No exact report, fix, or payment date stated
- Researcher says Apple's investigation found no misuse; independent vendor payout confirmation was not retrieved
- USD is inferred from earlier program-level context, not explicitly stated in the individual payment report. The May 2019 guide does not establish the payment's category or the program wording at payment time. No conflicting denomination was identified in the reviewed sources.
Recorded timeline
- Published
- 2020-05-30explicit
Related visual models
An identity claim must belong to the user
Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.
Sources and provenance
- Sign in with Apple failed to bind identity claims to the authenticated user Bhavuk Jain · reviewed 2026-10-04
- iOS Security, iOS 12.3, May 2019, printed page 87: denomination context only Apple · reviewed 2026-10-04
Record reviewed 2026-10-04. Snapshot d5550c789111. Open the complete JSON contract.