Zero-Day: Hijacking iCloud Credentials with Apple Airtags (Stored XSS)

It should definitely be corrected. But it’s highly unlikely that this attack will claim many victims. Even less so with articles like these informing their readers that login is not required on found.apple.com.

Good read though.

Hopefully they reported this to Apple before publishing this...

EDIT: Spelling