CVE-2025-68711

AppLockZ App Lock and Fingerprint Lock (applock.passwordfingerprint.applockz) 4.2.11 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an overlay rather than by using Android's secure authentication APIs. By navigating cascading interface flows - insecure navigation through exposed routes facilitates app control evasion {I.N.T.E.R.F.A.C.E] via advertisement or browser intents, an attacker can evade lockscreen verification and access protected apps (e.g., Chrome). This results in information disclosure and privilege escalation.

CVSS v3 2.4 LOW

2.4^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/actuator/applock.passwordfingerprint.applockz
https://github.com/actuator/applock.passwordfingerprint.applockz/blob/main/CVE-2025-68711
https://play.google.com/store/apps/details?id=applock.passwordfingerprint.applockz

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-26 21:16

Updated : 2026-07-23 11:10

NVD link : CVE-2025-68711

Mitre link : CVE-2025-68711

CVE.ORG link : CVE-2025-68711

JSON object : View

Products Affected

No product.

CWE

CWE-288

Authentication Bypass Using an Alternate Path or Channel

{"id": "CVE-2025-68711", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68711", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T20:32:49.016113Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-05-26T21:16:36.043", "references": [{"url": "https://github.com/actuator/applock.passwordfingerprint.applockz", "source": "cve@mitre.org"}, {"url": "https://github.com/actuator/applock.passwordfingerprint.applockz/blob/main/CVE-2025-68711", "source": "cve@mitre.org"}, {"url": "https://play.google.com/store/apps/details?id=applock.passwordfingerprint.applockz", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-288"}]}], "descriptions": [{"lang": "en", "value": "AppLockZ App Lock and Fingerprint Lock (applock.passwordfingerprint.applockz) 4.2.11 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an overlay rather than by using Android's secure authentication APIs. By navigating cascading interface flows - insecure navigation through exposed routes facilitates app control evasion {I.N.T.E.R.F.A.C.E] via advertisement or browser intents, an attacker can evade lockscreen verification and access protected apps (e.g., Chrome). This results in information disclosure and privilege escalation."}, {"lang": "es", "value": "AppLockZ Bloqueo de Aplicaciones y Bloqueo por Huella Dactilar (applock.passwordfingerprint.applockz) 4.2.11 para Android permite a un atacante local con acceso f\u00edsico eludir el bloqueo por PIN. El bloqueo est\u00e1 implementado como una superposici\u00f3n en lugar de usar las API de autenticaci\u00f3n seguras de Android. Al navegar por flujos de interfaz en cascada - la navegaci\u00f3n insegura a trav\u00e9s de rutas expuestas facilita la evasi\u00f3n del control de la aplicaci\u00f3n {I.N.T.E.R.F.A.C.E] a trav\u00e9s de intenciones de publicidad o del navegador, un atacante puede evadir la verificaci\u00f3n de la pantalla de bloqueo y acceder a aplicaciones protegidas (p. ej., Chrome). Esto resulta en revelaci\u00f3n de informaci\u00f3n y escalada de privilegios."}], "lastModified": "2026-07-23T11:10:00.120", "sourceIdentifier": "cve@mitre.org"}