CVE-2016-4644

CVE-2016-4644 describes a downgrade vulnerability in HTTP authentication credentials stored in Keychain across iOS, tvOS, and OS X El Capitan versions prior to their respective security updates. This flaw allowed an attacker to potentially compromise the confidentiality of saved credentials due to improper storage of authentication types. Rated as Medium severity (CVSS 6.5), it could lead to high confidentiality impact with low attack complexity, requiring authenticated access but no user interaction. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion, though it did receive limited media coverage.