A local attacker with physical access to an Android device can bypass the fingerprint or PIN authentication enforced by SpSoft AppLock (com.sp.protector.free). The application uses a custom overlay that inconsistently enforces the biometric or PIN challenge; by exploiting exposed navigation routes and advertising or browser intents, the attacker can exit the lock interface without completing authentication. This grants access to protected applications such as the Chrome browser, resulting in information disclosure and elevated privileges on the device.

SpSoft AppLock version 7.9.40 running on Android devices. No other vendors or product versions are listed in this CVE record.

The exploit requires physical access and hinges on the application's poorly enforced overlay and exposed intent routes. The EPSS score is reported as below 1%, indicating a very low likelihood of exploitation. The CVSS score of 5.5 reflects medium severity, capturing the potential for privilege escalation and data exposure, though the exploitation probability remains limited. The vulnerability is not listed in CISA KEV.