Yes—SEC Consult reported that flaws in Apple’s outbound iCloud Mail infrastructure let an authenticated sender make messages appear to come from arbitrary @icloud.com addresses and pass SPF, DKIM, and DMARC checks. The issue is historical: SEC Consult says it confirmed Apple’s deployed fixes on December 9, 2025. A forged From address does not, by itself, mean anyone accessed the Apple Account named in it.
What the iCloud Mail flaw allowed
In a technical report published October 1, 2026, SEC Consult described two related parsing flaws in iCloud Mail’s outbound infrastructure. In demonstrations, an authenticated iCloud sender could craft messages that displayed an arbitrary @icloud.com address in the From field. The messages were sent through Apple’s legitimate mail systems and passed SPF, DKIM, and DMARC checks, according to the report: SEC Consult’s technical disclosure.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Cryptnox FIDO2 Security Key NFC Smart Card for 2FA MFA Passwordless Login | $30.99 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
This was a sender-spoofing flaw, not evidence of a general Apple Account compromise. The report does not establish that attackers took over the accounts whose addresses appeared in the forged messages, nor does it give a victim count or prevalence figure.
How sender spoofing and email authentication fit together
Email passes through systems that interpret message headers and content. SEC Consult says the two approaches involved CRLF/header injection and a discrepancy involving dot-stuffing and dot-peeling. In both cases, different stages of Apple’s mail pipeline interpreted crafted content inconsistently. That could lead a trusted outbound service to accept and sign a sender identity the submitting user did not control. The report’s practical lesson is that inconsistent parsing inside a trusted service can undermine sender validation; reproducing the issue is not necessary to understand the risk.
#1 Best Overall
- FIDO2 CERTIFIED: FIDO Alliance Certified FIDO2 v2.1 and CTAP Level 1 for 2FA and MFA on Google Microsoft Apple GitHub login.gov AGOV SwissID and any WebAuthn service
- PASSKEY READY: Works as a hardware passkey for passwordless sign-in where the service enables it and as a U2F and WebAuthn security key everywhere else
- CERTIFIED SECURITY: NXP JCOP 4.5 secure element rated Common Criteria EAL6+ (augmented)
- TAP OR INSERT: Dual NFC ISO 14443 and contact ISO 7816 interface in an ID-1 format smart card that is passive and battery-free
- BUILT TO LAST: Passive smart card made in Switzerland designed by Swiss company Cryptnox and backed by a 2 year manufacturer warranty
SPF, DKIM, and DMARC are domain-authentication mechanisms, not proof of which human composed a message or owns the visible From address. Apple’s iCloud Mail postmaster information says iCloud Mail uses SPF and DKIM to authenticate inbound mail, signs outbound email with DKIM, and publishes DMARC with a p=quarantine policy for its mail domains. Apple says that policy took effect July 2, 2018. In this case, the report says the messages passed checks because they went through Apple’s legitimate infrastructure and were signed there; the defect was in how that infrastructure handled sender fields. The incident therefore does not mean those protocols were absent or inherently broken.
Does an @icloud.com From address prove who sent the email?
No. A visible address is not, on its own, proof that the person or account named in the From field sent the message. This disclosure is a specific example of why even successful domain-authentication checks cannot always establish a person’s identity when a trusted sending service has mishandled the sender information.
Apple’s support page explains that @icloud.com, @me.com, and @mac.com addresses depend on account history: accounts created on or after September 19, 2012 receive an @icloud.com address, while some earlier MobileMe and iCloud users can retain other suffixes. Apple also says an email alias cannot be used to sign in to iCloud.com. Those account details do not verify who sent a particular message. See Apple’s explanation of iCloud email addresses and aliases.
Free tools Windows power users keep installed
One-click scans. No signup required.
Apple’s iCloud terms prohibit impersonating another person or iCloud user and forging email headers to mislead recipients about a message’s origin, identifying that behavior as spoofing.
Is the vulnerability fixed?
SEC Consult says the deployed fixes remediated the issues and that researcher Timo Longin confirmed this on December 9, 2025. That fix status is the researcher’s verification; the cited disclosure does not establish a separate Apple security advisory for these specific flaws. SEC Consult published its account on October 1, 2026, after describing a disclosure process that began in 2024.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Disclosure timeline
| Date | What SEC Consult reported |
|---|---|
| May 21, 2024 | Longin submitted the initial report to Apple, describing CRLF injection in the From header and spoofed mail with valid DKIM and DMARC. |
| October 17, 2024 | Apple said changes had been made; SEC Consult later confirmed the original proof of concept no longer worked. |
| November 19, 2024 | SEC Consult’s timeline records a $15,000 Apple Security Bounty for the initial report. |
| December 6–12, 2024 | SEC Consult found and reported a second related parsing issue, saying the first deployed fix was insufficient. |
| May–June 2025 | After Apple asked the researcher to reassess an update, SEC Consult reported that a bypass remained. |
| November 11–12, 2025 | SEC Consult said its previous proof of concept no longer worked, and Apple said updates had been pushed. |
| December 9, 2025 | Longin confirmed deployed fixes remediated the original issue, according to SEC Consult. |
| October 1, 2026 | SEC Consult publicly released the technical report. |
The $15,000 figure is a bounty recorded for the initial report, not a measure of exploitation or the number of affected people. SEC Consult’s report provides no incident count for this issue.
Quick Recap
What this means for email users and administrators
- For recipients: Treat a sender address and authentication indicators as useful signals, not conclusive proof of a person’s identity. Be especially cautious with unexpected requests for passwords, payment, or urgent action.
- For mail administrators: The disclosure highlights the importance of validating sender fields consistently at every stage of outbound processing. Authentication at the receiving system cannot repair a mistaken sender identity accepted and signed by a trusted sending service.
- For Hide My Email users: This report concerns outbound iCloud Mail parsing, not Apple’s separate Hide My Email relay feature. Apple’s Sign in with Apple white paper describes relay addresses that forward to a verified inbox and says sending domains must be registered and use standard DKIM, DMARC, and SPF policies.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
