AIKIDO-2026-511207

TL;DR

The Apple OAuth provider derives the expected OAuth state from the nonce embedded in the caller-supplied identity token and compares that value against itself, and it accepts stateless callbacks with no CSRF check at all. A callback captured from the attacker's own Sign in with Apple login is accepted when replayed in the victim's browser, and the identity token's nonce and aud claim go unverified. This silently logs the victim into, or links their account to, the attacker's Apple identity without any credentials. The fix generates a random nonce on redirect, verifies it against the identity token, and rejects callbacks with missing or invalid state.