CVE-2020-35207: 
LastPass vulnerability analysis and mitigation

A disputed vulnerability was discovered in the LogMein LastPass Password Manager (com.lastpass.ilastpass) app version 4.8.11.2403 for iOS. The vulnerability, identified as CVE-2020-35207, involves the PIN authentication mechanism for unlocking the vault. The issue was discovered where the PIN authentication could be bypassed by forcing the authentication result to be true through runtime manipulation, effectively allowing authentication with any arbitrary PIN (NVD, LastPass Vulnerabilities).

The vulnerability affects the PIN authentication mechanism used for unlocking the LastPass vault. Through runtime manipulation, an attacker could force the authentication result to return true, regardless of the PIN entered. The vulnerability has been assigned a CVSS v3.1 base score of 5.7 (MEDIUM) with the vector string CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating that physical access is required and attack complexity is high (NVD).

If successfully exploited, the vulnerability would allow an attacker with physical access to the device to bypass the PIN authentication mechanism and gain unauthorized access to the password vault. This could potentially expose all stored credentials and sensitive information within the LastPass vault (NVD).

The vulnerability requires a jailbroken iOS device to exploit, as runtime manipulation of the application is necessary. A proof-of-concept demonstration has been published showing the successful bypass of the PIN authentication mechanism (LastPass Vulnerabilities).

LastPass has disputed this vulnerability, stating that it falls outside their threat model which explicitly excludes jailbroken devices. As such, no official fix has been released as the vendor considers this an invalid attack scenario (NVD).