# Zero-day in Sign in with Apple

Sign in with Apple issued valid JWTs for any arbitrary email address, letting attackers forge id_tokens and take over accounts on third-party apps.

- Payout: $100,000
- Severity: critical
- Program: Apple
- Credited: Bhavuk Jain
- Disclosed: 2020-05-30
- Write-up quality: 7/10
- Original: https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-apple/
- Library page: https://bugbountylibrary.com/r/blog%3Abhavukjain-com-blog-2020-05-30-zeroday-signin-with-apple
- Tags: domain:web impact:ato kind:bounty platform:blog sev:critical tech:jwt tech:oauth technique:source-review vuln:account-takeover vuln:auth-bypass

**Target:** appleid.apple.com OAuth/JWT authorization endpoint
**Root cause:** The token-issuing endpoint accepted an arbitrary email in the authorization request and minted a validly signed id_token binding that email, without verifying the requester owned it.
**Steps:**
1. Obtain a valid authorization flow context for a third-party app using Sign in with Apple
2. Send `POST /XXXX/XXXX HTTP/1.1` to `appleid.apple.com` with body `{"email":"victim@example.com"}`
3. Receive response containing a signed `id_token` JWT whose `email` claim is the victim's address
4. Verify the JWT signature against Apple's public key — it validates
5. Submit the id_token to the third-party app's login endpoint to authenticate as the victim
**How found:** Researcher studied the OAuth-like JWT issuance flow and tested whether the email supplied during authorization was bound to the authenticated Apple user, discovering arbitrary emails yielded valid signed tokens.
**Exploitation:** Attacker requests a JWT for the victim's email from Apple, gets a validly signed id_token, and replays it to any third-party app that trusts Apple's signature without additional checks, logging in as the victim regardless of whether the victim has an Apple ID.
**Insight:** In federated identity flows, test whether the identity claim (email/sub) in the issued token is actually bound to the authenticated principal — try supplying arbitrary identifiers at the token-minting step and check if the signature still validates.