CVE-2025-68711

Vulnerability

AppLockZ App Lock and Fingerprint Lock (applock.passwordfingerprint.applockz) version 4.2.11 for Android implements a PIN lock as an overlay rather than leveraging Android's secure authentication APIs. This design flaw allows the lock to be bypassed. The vulnerability is present in version 4.2.11 as described in the official description and references [1][2].

Exploitation

A local attacker with physical access to the device can bypass the PIN lock by navigating cascading interface flows. Specifically, the attacker can exploit insecure navigation through exposed routes to evade app control, leveraging advertisement or browser intents to circumvent the lockscreen verification and access protected applications (e.g., Chrome). No authentication or special privileges are required beyond physical possession of the unlocked device [1][2].

Impact

Successful exploitation enables the attacker to access protected apps, resulting in disclosure of sensitive information stored within those apps and local privilege escalation. The attacker can bypass the intended access controls of the AppLockZ overlay, compromising the confidentiality and integrity of user data [1][2].

Mitigation

As of the publication date (2026-05-26), no official fix has been disclosed in the available references. The vendor has not released a patched version or provided a workaround. Users should consider alternative app lock solutions that properly use Android's secure authentication APIs until a fix is available [1][2][3].