Apple Private Relay flaw exposed: passkeys can reveal your real IP

Apple’s iCloud Private Relay, the iCloud+ feature that’s supposed to mask your IP address in Safari, is currently exposing real IP addresses during passkey authentication on iPhone and iPad, according to findings from security researchers Tommy Mysk and Talal Haj Bakry.

NordVPN Download

Mysk and Haj Bakry say that on iPhone and iPad, passkey requests get handed off from Safari, and from every other iOS browser too, since Apple requires WebKit, to the operating system’s credential service. That handoff doesn’t pass through the Private Relay proxy. A malicious site that supports passkeys, or simply claims it does, could use that gap to learn your actual address.

If you depend on Apple’s iCloud Private Relay for anonymity, that matters for a larger reason: Mysk and Haj Bakry’s research also points to DNS prefetching and WebTransport as other ways around it. That’s a reminder that Private Relay isn’t a full VPN and doesn’t cover all traffic from your device.

Apple reportedly described the flaw as “dire” and allowed it to be disclosed, but there’s still no exact date for a fix. One report suggests a broader solution may not show up until fall 2026. Put that next to a recent Apple Hide My Email bug that exposed some real addresses, and it’s easy to see why people would start doubting Apple’s paid privacy tools.

Apple’s iCloud Private Relay is still available through iCloud+ on iPhone and iPad, but if hiding your IP address is critical, you may still need a traditional VPN.

ExpressVPN Download