CVE-2025-68712 affects SpSoft AppLock (com.sp.protector.free) version 7.9.40 on Android. The vulnerability arises because the app's custom lock overlay fails to reliably enforce biometric or PIN authentication. An attacker with physical access can exploit insecure navigation paths exposed via advertisement or browser intents to bypass the lock screen. This allows unauthorized access to protected apps without re-authentication, resulting in information disclosure and privilege escalation. The CVSS 3.1 base score is 5.5 (medium severity), with attack vector local, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or official remediation is currently documented.

Successful exploitation allows a local attacker with physical access to bypass the app lock authentication, gaining unauthorized access to protected applications and potentially sensitive information. This leads to information disclosure and privilege escalation on the affected device. There is no indication of remote exploitation or impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should limit physical access to their devices and consider using alternative app locking solutions with verified security. No official remediation or temporary fix is documented at this time.