CVE-2025-68712: SpSoft AppLock Auth Bypass Vulnerability

CVE-2025-68712 Overview

CVE-2025-68712 is an authentication bypass vulnerability in SpSoft AppLock (com.sp.protector.free) version 7.9.40 for Android. The application provides fingerprint and PIN-based protection for other installed apps, but its lock screen is implemented as a custom overlay that fails to consistently enforce authentication. A local attacker with physical access can navigate through cascading interface flows, such as advertisement prompts or browser intents, to exit the lock interface without re-authentication. This bypass exposes protected applications including browsers like Chrome, resulting in information disclosure and privilege escalation on the device.

Critical Impact

Physical-access attackers can bypass biometric and PIN locks to reach protected applications, leading to information disclosure and elevated access to user data.

Affected Products

• SpSoft AppLock (com.sp.protector.free) version 7.9.40
• Android devices with the SpSoft AppLock package installed
• Protected third-party applications routed through the AppLock overlay (for example, Chrome)

Discovery Timeline

• 2026-05-27 - CVE-2025-68712 published to the National Vulnerability Database
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2025-68712

Vulnerability Analysis

SpSoft AppLock enforces access control through a custom activity overlay that intercepts launches of protected apps and demands fingerprint or PIN authentication. The overlay integrates Android's biometric APIs but does not maintain authentication state across all interface transitions. When the overlay surfaces secondary UI elements such as in-app advertisements or external browser intents, those flows expose navigation routes that exit the lock screen. The lock activity does not re-prompt for credentials when the user returns to the protected application, breaking the security boundary. This is classified as an Authentication Bypass affecting a mobile app, with characteristics of Broken Access Control and Intent Redirection.

Root Cause

The root cause is inconsistent enforcement of authentication state within the overlay activity. The application relies on UI-layer gating rather than a persistent authentication check tied to each protected app launch. Cascading interface flows, including advertisement views and Intent-driven transitions to external apps, create navigation paths that bypass the authentication prompt entirely.

Attack Vector

Exploitation requires local, physical access to an unlocked device with SpSoft AppLock installed and configured. The attacker triggers a protected app, then interacts with secondary UI surfaces rendered by the AppLock overlay, such as advertisement banners or browser-handling intents. By following these exposed navigation routes, the attacker exits the lock interface and re-enters the protected application without supplying the fingerprint or PIN. The vulnerability mechanism is described in the public reference at the GitHub CVE-2025-68712 Reference; no verified exploit code is republished here.

Detection Methods for CVE-2025-68712

Indicators of Compromise

• Presence of com.sp.protector.free version 7.9.40 on managed Android devices
• Unexpected launches of protected applications such as Chrome immediately following AppLock overlay activity without a corresponding biometric or PIN authentication event
• Browser intents or advertisement-related activity transitions originating from the AppLock package in device logs

Detection Strategies

• Inventory installed Android applications across managed devices and flag any instance of com.sp.protector.free at version 7.9.40 or earlier
• Review Android logcat and mobile telemetry for activity transitions from com.sp.protector.free to protected packages without an intervening biometric prompt event
• Correlate user-reported access anomalies with AppLock version data collected through mobile device management (MDM) inventory

Monitoring Recommendations

• Configure MDM policies to report SpSoft AppLock version and alert on the vulnerable build
• Monitor for outbound browser intents and ad-network traffic that align with AppLock-mediated app launches
• Track repeated failed-then-successful access patterns to apps designated as protected by AppLock

How to Mitigate CVE-2025-68712

Immediate Actions Required

• Identify devices running SpSoft AppLock com.sp.protector.free version 7.9.40 and treat protected app contents as potentially exposed
• Stop relying on SpSoft AppLock as a sole control for protecting sensitive applications on shared or physically accessible devices
• Enforce the native Android device lock with a strong PIN, password, or biometric as the primary authentication boundary

Patch Information

No vendor patch is referenced in the available CVE data. Monitor the Google Play App Page for an updated release that addresses the overlay authentication bypass, and review the GitHub Repository for further technical disclosure.

Workarounds

• Uninstall SpSoft AppLock from devices that store sensitive data until a fixed version is published
• Use Android's built-in app pinning, work profile separation, or platform-level controls instead of third-party overlay locks
• Disable advertisement-driven flows and restrict browser intents on devices that must retain the application, recognizing this only reduces but does not eliminate exposure

# Identify the vulnerable package and version via ADB
adb shell pm list packages | grep com.sp.protector.free
adb shell dumpsys package com.sp.protector.free | grep versionName

# Remove the vulnerable application for the current user
adb shell pm uninstall --user 0 com.sp.protector.free