This issue was addressed by improving Face ID machine learning models.
Date: 2019-12
Affected: apple/iphone_os
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2019-8760
CWE: CWE-287
CVSS: 6.8 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

This issue was addressed by improving Face ID machine learning models. This issue is fixed in iOS 13. A 3D model constructed to look like the enrolled user may authenticate via Face ID.


Mitigations:

Architectural layers (MAESTRO):