Post #2649925

2026-05-15 15:03 UTC

NOTICE: Shortcuts broke its x-callback-url implementation. Seems to be part of the security fix for CVE-2026-28993 included in iOS 26.5/18.7.9, macOS 26.5/15.7.7/14.8.7. On these OSes, it’s no longer possible to get a result from a Shortcut call via `x-success` callback, you will *always* get an x-error. In theory, per the CVE, Shortcuts should offer a permissions prompt, not just fail. Apple Folks: FB22785648

Replies (2)

@johnbrayton@iosdev.space 2026-05-15 15:18

@agiletortoise@mastodon.social I encountered this as well, and was able to work around it by making my shortcuts end in a “Stop this shortcut” action. But my app doesn’t need output from shortcuts, it just needs to know whether the shortcut succeeded. I don’t know how or if that can work if you need a shortcut to return a result.

Open ##2957945
@chockenberry@mastodon.social 2026-05-15 16:26

@agiletortoise@mastodon.social Thanks for finding the CVE and writing this up! We’ll certainly dupe the FB. We’re seeing the same issue with Wallaroo.

Open ##2957947