# CVE-2020-24653: Expo secure-store iOS incorrect security attribute application

Source: https://junglewise.ai/threats/cve-2020-24653-expo-secure-store-ios-incorrect-security-attribute-application  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-24653 · Severity: info · CVSS 3.3 · Published 2022-05-24

Expo's secure-store library on iOS applies an insecure credential storage policy when developers request protection for credentials that should only be accessible when the device is unlocked. This causes sensitive data like passwords and API keys to be stored with weak protection, allowing attackers with physical device access to extract credentials even if the device is locked.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-24653 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-24653 being exploited in the wild.

**How severe is CVE-2020-24653?** Informational severity, with a CVSS score of 3.3, published 24 May 2022.

**Which products and versions are affected?** expo (npm) SEMVER:introduced=0,fixed=9.1.0.

**Is there a fix for CVE-2020-24653?** Yes. expo (npm): upgrade to 9.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-24653 attacked?** It is attacked with physical access.

**Am I affected by CVE-2020-24653?** Check whether you run expo (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- expo (npm): upgrade to 9.1.0 or later

  ```sh
  npm install expo@9.1.0
  ```


## Technical details

The secure-store module in Expo through version 9.1.0 uses an incorrect iOS Keychain security attribute when the WHEN_UNLOCKED_THIS_DEVICE_ONLY flag is specified. Instead of applying the secure kSecAttrAccessibleWhenUnlockedThisDeviceOnly policy, it applies kSecAttrAccessibleAlwaysThisDeviceOnly, which allows credential access even when the device is locked. This is a configuration error in the iOS native code. The vulnerability affects any application using Expo secure-store on iOS that relies on the WHEN_UNLOCKED_THIS_DEVICE_ONLY flag for credential protection. The fix was merged in pull request #9264 and available from version 9.1.0 onward.

## Affected products

- Expo expo through 9.1.0

## Identifiers

- CVE-2020-24653
- GHSA-rwx9-wqj8-vr77

## Timeline

- 2020-08-26: disclosed
- 2020-07-17: patched: Fix merged in PR #9264
- 2022-05-24: advisory

## References

- [https://github.com/expo/expo/pull/9264](https://github.com/expo/expo/pull/9264)

## Related threats

- [Expo SDK OAuth vulnerability in AuthSession redirect proxy](https://junglewise.ai/threats/cve-2023-28131-expo-sdk-oauth-vulnerability-in-authsession-redirect-proxy)