This issue describes the same bug as in issue #220 . The aforementioned issue sat opened for over 2 weeks now, so I'm creating this one to describe the issue in more detail and (hopefully) help get it fixed. This is a critical vulnerability that allows an attacker to disable all app locks in less than 3 taps.
Affected devices:
All devices with biometric authentication turned on and backend implementation set to Accessibility Service.
Mitigation for users (until the bug gets fixed):
Use an alternative backend implementation (Usage statistics or Shizuku), or disable biometric authentication in App Lock settings menu.
Technical Description:
When opening a locked app, tapping "Use PIN" on the native BiometricPrompt dismisses the prompt, and the App Lock PIN overlay vanishes. Subsequent app launches fail to trigger the lock overlay until the service or device is restarted.
Logs:
The accessibility service gets trapped in an early-return loop because isLockScreenShown is never set back to false upon biometric prompt cancellation. I've uploaded the raw Security/audit log to https://pastebox.fyi/AX8Z584B7L and https://github.com/user-attachments/files/30545780/audit_log.txt
This issue describes the same bug as in issue #220 . The aforementioned issue sat opened for over 2 weeks now, so I'm creating this one to describe the issue in more detail and (hopefully) help get it fixed. This is a critical vulnerability that allows an attacker to disable all app locks in less than 3 taps.
Affected devices:
All devices with biometric authentication turned on and backend implementation set to Accessibility Service.
Mitigation for users (until the bug gets fixed):
Use an alternative backend implementation (Usage statistics or Shizuku), or disable biometric authentication in App Lock settings menu.
Technical Description:
When opening a locked app, tapping "Use PIN" on the native BiometricPrompt dismisses the prompt, and the App Lock PIN overlay vanishes. Subsequent app launches fail to trigger the lock overlay until the service or device is restarted.
Logs:
The accessibility service gets trapped in an early-return loop because isLockScreenShown is never set back to false upon biometric prompt cancellation. I've uploaded the raw Security/audit log to https://pastebox.fyi/AX8Z584B7L and https://github.com/user-attachments/files/30545780/audit_log.txt