Security hole: Can bypass lock screen by scanning any qr code

[Marty Neal]

I am able to login to my phone by opening my camera app with a gesture (twisting my hand twice) and scanning a QR code that represents a URL. By clicking the link, chrome opens up and I am able to hit the home button and I am logged into my phone without ever unlocking it. This seems like a pretty drastic security hole on the stock moto camera app. I believe it SHOULD prompt for the pin/pattern after clicking the link before opening a browser.

Phone details:
Android v 7.0
Security patch level November 1, 2017
Kernel version 3.18.31-perf-g05b6df7
Build number NPN25.137-93

App details:
Name: Moto Camera
Version: 6.2.5.16

 

[psionandy]

Have you reported it to Motorola?

 

[Unforgiven]

Tested on Moto X4, asked me for a pin before it would open the URL.