CVE-2025-68711 describes a vulnerability in AppLockZ App Lock and Fingerprint Lock (version 4.2.11) for Android where the PIN lock is implemented as an overlay rather than using Android's secure authentication APIs. This design flaw allows a local attacker with physical access to bypass the lock by navigating cascading interface flows through exposed routes such as advertisement or browser intents. Exploiting this insecure navigation enables evasion of lockscreen verification and unauthorized access to protected applications like Chrome, resulting in information disclosure and privilege escalation. The vulnerability is classified under CWE-288 (Authentication Bypass) and has a CVSS 3.1 base score of 2.4, indicating low severity. There is no vendor advisory or patch currently available.

The vulnerability allows local attackers with physical access to bypass the app's PIN lock, potentially gaining unauthorized access to protected applications. This can lead to information disclosure and privilege escalation within the affected device. However, the impact is rated low based on the CVSS score and the requirement for physical access. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider avoiding reliance on this app for sensitive protection or use additional device-level security measures. No vendor advisory or official remediation instructions are currently provided.