CVE-2025-68708

SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an overlay rather than by using Android's secure authentication APIs. By navigating cascading interface flows - insecure navigation through exposed routes facilitates app control evasion {I.N.T.E.R.F.A.C.E] via advertisement or browser intents - an attacker can evade lockscreen verification and access protected apps (e.g., Chrome). This results in information disclosure and privilege escalation.

CVSS v3 2.4 LOW

2.4^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/actuator/com.alpha.applock
https://github.com/actuator/com.alpha.applock/blob/main/CVE-2025-68708
https://play.google.com/store/apps/details?id=com.alpha.applock

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-26 21:16

Updated : 2026-07-24 11:10

NVD link : CVE-2025-68708

Mitre link : CVE-2025-68708

CVE.ORG link : CVE-2025-68708

JSON object : View

Products Affected

No product.

CWE

CWE-288

Authentication Bypass Using an Alternate Path or Channel

{"id": "CVE-2025-68708", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68708", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T20:33:26.882763Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-05-26T21:16:35.940", "references": [{"url": "https://github.com/actuator/com.alpha.applock", "source": "cve@mitre.org"}, {"url": "https://github.com/actuator/com.alpha.applock/blob/main/CVE-2025-68708", "source": "cve@mitre.org"}, {"url": "https://play.google.com/store/apps/details?id=com.alpha.applock", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-288"}]}], "descriptions": [{"lang": "en", "value": "SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an overlay rather than by using Android's secure authentication APIs. By navigating cascading interface flows - insecure navigation through exposed routes facilitates app control evasion {I.N.T.E.R.F.A.C.E] via advertisement or browser intents - an attacker can evade lockscreen verification and access protected apps (e.g., Chrome). This results in information disclosure and privilege escalation."}, {"lang": "es", "value": "SailingLab AppLock (tambi\u00e9n conocido como com.alpha.applock) 4.3.8 para Android permite a un atacante local con acceso f\u00edsico eludir el bloqueo por PIN. El bloqueo se implementa como una superposici\u00f3n en lugar de utilizar las API de autenticaci\u00f3n seguras de Android. Al navegar por flujos de interfaz en cascada - la navegaci\u00f3n insegura a trav\u00e9s de rutas expuestas facilita la evasi\u00f3n del control de la aplicaci\u00f3n {I.N.T.E.R.F.A.C.E] a trav\u00e9s de intenciones de publicidad o del navegador - un atacante puede evadir la verificaci\u00f3n de la pantalla de bloqueo y acceder a aplicaciones protegidas (por ejemplo, Chrome). Esto resulta en revelaci\u00f3n de informaci\u00f3n y escalada de privilegios."}], "lastModified": "2026-07-24T11:10:00.170", "sourceIdentifier": "cve@mitre.org"}