Description
secure-store in Expo through 9.1.0 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.
Recommendation
Update the expo package to the latest compatible version. Followings are version details:
- Affected version(s): < 9.1.0
- Patched version(s): 9.1.0
References
Could your website be exposed too?
SmartScanner can check your website for Expo on iOS is insecure due incorrect security attribute application and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Incorrect Calculation in the MSR JavaScript Cryptography Library - CVE-2020-1026
- MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827 - CVE-2025-67898
- survey-pdf Upgraded jsPDF Version Due to Security Vulnerability - CVE-2026-25630
- ion-parser Prototype Pollution when malicious INI file submitted to application that parses with `parse` - CVE-2020-28462
You might also like:
See something that needs correcting? Let us knowUpdated February 02, 2023