CVE-2025-43201: Credential Exposure Vulnerability in Apple Music Classical for Android
Description:
A security patch was released in Apple Music Classical 2.3 for Android (version 9.0 and later) on 19th of June,2025. The vulnerability allows the app to unexpectedly leak a user’s credentials. This flaw was addressed by Apple with improved internal validation and checks to prevent such leaks.
Proof of Concept:
The security researcher Pankaj Kumar Thakur, Chief Information Security Officer (CISO) at GreenTick Nepal, reported the vulnerability. Although official Proof of Concept details are not publicly disclosed by Apple, the exposure of user credentials could be triggered through the app’s insufficient validation, potentially allowing an attacker access to sensitive authentication data.
Solution:
Apple Music Classical 2.3 for Android released fixes incorporating improved verification checks. Users are advised to update the app to the latest version available on the Google Play Store to mitigate this vulnerability.
| CVE-ID | Description | Products |
| CVE-2025-43201 | Apple Music Classical 2.3 for Android unexpectedly leaks user credentials due to insufficient validation. | Apple Music Classical 2.3 for Android (version 9.0 and later) |
History:
- 2025-06-19: Released Date
- 2025-08-15: Published Date
