CVE-2025-68712 affects SpSoft AppLock (com.sp.protector.free) version 7.9.40 on Android. The vulnerability arises because the app implements its lock screen with a custom overlay that does not consistently enforce biometric or PIN authentication. An attacker with physical access can exploit insecure navigation paths exposed via advertisement or browser intents to bypass the lock interface. This allows the attacker to exit the lock screen without re-authentication and access protected applications, resulting in unauthorized information disclosure and privilege escalation.

The vulnerability enables a local attacker with physical access to bypass authentication controls intended to protect apps on the device. This can lead to unauthorized access to sensitive applications such as web browsers, potentially exposing private information and elevating privileges on the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid granting physical access to untrusted individuals and consider using alternative app locking solutions with verified security. Monitor vendor channels for updates or patches addressing this issue.