Lockscreen Authentication Bypass

[pcheynem1520]

Samsung Galaxy
F-droid v1.1.10

I noticed that that lockscreen authentication can be bypassed by pressing the back button twice instead of authenticating whem prompted. I haven't yet been able to figure out the exact conditions to make it work, but I've done it ~10 times in ~20 attempts since noticing the issue.

So far I think the app needs to have been unlocked at least once since last full app close.

[pcheynem1520]

I've found that the background image behind the authentication prompt is a reliable way to tell if the bypass will work, but I'm still not certain on how to reliably force the issue. It seems to be time-dependant, but I haven't had time to find the exact timeframes.

Bypass will work:

Bypass will fail:

[dreautall]

Interesting, the first image is the Android screen when opening an app - maybe the back key gets queued and triggers before the lock code runs? So far I haven't been able to replicate it, despite trying every time I open the app. Maybe when I force the emulator to be very slow I can "catch the moment".

[pcheynem1520]

@dreautall when I said it's about timing, I didn't mean timing it to a second. It seems like it can sit on the lock screen indefinitely. When I open the app and it is requesting lock screen auth, it either can be bypassed or it can't.

[pcheynem1520]

I managed to get a screen recording of it happening (the screen recording goes black during the lock screen prompt).

I closed the app and let it time out to the lock screen after a couple minutes. If you wait too long, it no longer works. Not yet certain how long is too long. Longest time between closing Waterfly and successful bypass is almost 30 minutes. Force closing the app in the multitasking screen seems to stop this bypass. If the large logo is visible, bypass is possible. Press back to close the lock screen prompt and back button on large logo screen. It doesn't seem to matter how long you sit on the screen lock or the Waterfly logo, if the wrong logo is in the background, the screen lock is useless.

Screen_Recording_20260306_133055.mp4