Security readout for executives and security teams
Plain-English summary
Expo secure-store for iOS through 2.16.1 used a weaker iOS Keychain accessibility setting than requested. Apps expecting secrets to be available only while the device is unlocked may have stored them in a form accessible even when locked. The business risk is mainly increased exposure after device loss, theft, or local compromise.
Executive priority
Treat this as a targeted mobile data-protection issue, not a broad remote compromise. Prioritize if the app stores authentication tokens, payment data, or regulated data on iOS devices, especially for high-risk user groups.
Technical view
When WHEN_UNLOCKED_THIS_DEVICE_ONLY was selected, Expo secure-store used kSecAttrAccessibleAlwaysThisDeviceOnly instead of the intended when-unlocked policy. The issue is limited by the provided sources to iOS secure-store through 2.16.1. The sources do not provide CVSS, CWE, detailed patch version, or exploit evidence.
Likely exposure
iOS apps using Expo secure-store through 2.16.1 and relying on WHEN_UNLOCKED_THIS_DEVICE_ONLY for sensitive values are the likely exposure. Products not using this package, not on iOS, or not using that policy are not supported by the provided evidence.
Exploitation context
No KEV listing or cited source in the bundle indicates active exploitation. Practical impact appears tied to local device access or compromise scenarios where locked-device Keychain accessibility matters. The provided sources do not describe remote exploitation.
Researcher notes
The source bundle is sparse: CVE metadata states the incorrect policy and affected version range, and references Expo PR 9264. It does not include CVSS, CWE, affected CPEs, exploit details, or a named fixed version. Avoid over-scoping beyond iOS Expo secure-store behavior.
Mitigation direction
- Inventory iOS apps using Expo secure-store 2.16.1 or earlier.
- Check Expo guidance and PR 9264 for the confirmed fixed release.
- Upgrade affected secure-store dependencies after confirming the vendor fix.
- Review whether high-value secrets were stored with WHEN_UNLOCKED_THIS_DEVICE_ONLY.
- Assess token rotation for users with lost, stolen, or compromised devices.
Validation and detection
- Confirm package versions in mobile dependency manifests and lockfiles.
- Review iOS code paths using WHEN_UNLOCKED_THIS_DEVICE_ONLY.
- Verify the built app uses the intended when-unlocked Keychain policy.
- Check release notes or vendor guidance before declaring remediation complete.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-24653 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/expo/expo/pull/9264CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.