SecuriTricks - CVE-2025-68708

Description

SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an overlay rather than by using Android's secure authentication APIs. By navigating cascading interface flows - insecure navigation through exposed routes facilitates app control evasion {I.N.T.E.R.F.A.C.E] via advertisement or browser intents - an attacker can evade lockscreen verification and access protected apps (e.g., Chrome). This results in information disclosure and privilege escalation.

Product(s) Impacted

Vendor	Product	Versions
Alpha	Sailinglab Applock	4.3.8

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-288

Authentication Bypass Using an Alternate Path or Channel

A product requires authentication, but the product has an alternate path or channel that does not require authentication.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	alpha	sailinglab_applock	4.3.8	/	/	/	/	android	/	/

References

https://github.com/actuator/com.alpha.applock

https://github.com/actuator/com.alpha.applock/blob/main/CVE-2025-68708

https://play.google.com/store/apps/details?id=com.alpha.applock

CVSS Score

2.4 / 10

CVSS Data - 3.1

Attack Vector: PHYSICAL
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: LOW
Integrity Impact: NONE
Availability Impact: NONE

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

View Vector String

Timeline

Published: May 26, 2026, 9:16 p.m.
Last Modified: May 27, 2026, 9:16 p.m.

Status : Deferred

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

CVE-2025-68708