A local attacker with physical access to a device can bypass the fingerprint or PIN authentication enforced by the SpSoft AppLock (com.sp.protector.free) application. The app uses a custom overlay that is not consistently enforcing the biometric or PIN challenge, allowing an attacker to navigate through insecure interface flows and exit the lock screen without completing authentication. This grants the attacker access to apps that the lock is intended to protect, such as the Chrome browser, resulting in the disclosure of user data and the ability to gain elevated privileges on the device.

SpSoft AppLock version 7.9.40 running on Android devices. No other product versions or vendors are listed in the CVE record.

The exploit requires physical access to the device; the attacker manipulates exposed routes and advertisement or browser intents to reach the application and bypass the lock overlay. There is no available EPSS score and the vulnerability is not listed in CISA KEV, but the lack of consistent authentication enforcement presents a high risk for local attackers. The determined CVSS score is not specified, yet the impact level is substantial due to the combination of authentication bypass and privilege escalation.