CVE-2025-68708 describes a vulnerability in SailingLab AppLock 4.3.8 for Android where the PIN lock mechanism is implemented as an overlay instead of leveraging Android's secure authentication APIs. This design flaw allows a local attacker with physical access to bypass the lock by exploiting insecure navigation through exposed routes triggered by advertisement or browser intents. The attacker can evade the lockscreen verification and access protected applications, leading to information disclosure and privilege escalation. The vulnerability is categorized under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). No official patch or remediation level has been provided, and no known exploits are reported in the wild.

The vulnerability allows a local attacker with physical access to bypass the app lock PIN, resulting in limited information disclosure and privilege escalation by accessing protected applications. The impact is limited by the requirement of physical access and the low CVSS score of 2.4. There is no indication of remote exploitation or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be cautious about physical access to their devices and consider alternative app lock solutions that use Android's secure authentication APIs. No vendor advisory or official remediation guidance is currently available.