Hi, I’m seeing a production issue on iOS 26+ that only affects some users.
symptoms:
It does NOT happen for all users.
It happens for a subset of users on iOS 26+.
If we write a value to Keychain and read it immediately in the same session, it succeeds.
However, after terminating the app and relaunching, the value appears to be gone:
SecItemCopyMatching returns errSecItemNotFound (-25300).
Repro (as observed on affected devices):
Launch app (iOS 26+).
Save PIN data to Keychain using SecItemAdd (GenericPassword).
Immediately read it using SecItemCopyMatching -> success.
Terminate the app (swipe up / kill).
Relaunch the app and read again using the same service -> returns -25300.
Expected:
The Keychain item should persist across app relaunch and remain readable (while the device is unlocked).
Actual:
After app relaunch, SecItemCopyMatching returns errSecItemNotFound (-25300) as if the item does not exist.
Implementation details (ObjC):
We store a “PIN” item like this (simplified):
addItem:
kSecClass: kSecClassGenericPassword
kSecAttrService: <FIXED_STRING>
kSecValueData:
kSecAttrAccessControl: SecAccessControlCreateWithFlags(..., kSecAttrAccessibleWhenUnlockedThisDeviceOnly, 0, ...)
readItem (SecItemCopyMatching):
kSecClass: kSecClassGenericPassword
kSecAttrService: <FIXED_STRING>
kSecReturnData: YES
(uses kSecUseOperationPrompt in our async method)
Question:
On iOS 26+, is there any known issue or new behavior where a successfully added GenericPassword item could later return errSecItemNotFound after app termination/relaunch for only some users/devices?
What should we check to distinguish:
OS behavior change/bug vs.
entitlement/access-group differences (app vs extension, provisioning/team changes),
device state/policies (MDM, passcode/biometrics changes),
query attributes we should include to make the item stable across relaunch?
Build / Dev Environment:
macOS: 15.6.1 (24G90)
Xcode: 26.2
Selecting any option will automatically load the page