If you use the Hide My Email service within iCloud+, be careful. A security researcher has pointed out a serious vulnerability that apparently allows you to reveal the real email address hidden behind an anonymous forwarding address. The unpleasant thing is that Apple They have reportedly known about the problem for over a year, yet they have not yet fixed it definitively.
You might be interested in
Hide My Email is among the most popular subscription features iCloud+. Allows you to create random email addresses that forward messages to your inbox without the other party knowing your real email. The function is ideal for registering on websites, in applications or anywhere where you do not want to share your main address. However, this protection is now allegedly violated by a newly described bug.
Gallery
Apple He has known about the problem since last year.
The vulnerability was reported by Tyler Murphy from EasyOptOuts. Apple According to him, he received a complete report, including the reproduction procedure, in June 2025. The company initially confirmed that it was investigating the problem, and in March this year even stated that it had resolved it with a system change. However, the researcher subsequently discovered that the vulnerability remained exploitable. Apple therefore, he reopened the investigation and, according to the latest information, promised a fix in one of the upcoming security updates.
Technical details of the vulnerability have not yet been made public. The 404 Media server, which verified the existence of the bug, deliberately did not publish them to prevent its mass exploitation. However, according to the researcher, during the tests, the real email addresses of all the anonymous aliases tested were revealed.
You might be interested in
The whole situation comes just a few weeks after Apple announced another change to Hide My Email. Now, all newly created anonymous addresses will use the domain private.icloud.com instead of the current domains. This change has previously drawn criticism from some users because it can make it easier for websites to recognize and potentially block anonymous email addresses. The current security flaw adds another unpleasant complication to the service.
