Local screen lock bypass via Ctrl + Esc in xfce4-screensaver (Kali Linux / VirtualBox)

A consistent local screen lock bypass vulnerability found in xfce4-screensaver running inside an Oracle VM VirtualBox environment. The lock screen process crashes or drops focus, granting immediate access to the active user session without entering the correct password.

Environment details:

OS: Kali Linux amd64 (Kernel: 6.19.14-kali1-amd64)Desktop Environment: Xfce 4.20Screen Saver Package: xfce4-screensaver (Version: 4.20.2-1)Hypervisor: Oracle VM VirtualBox (Host OS: Windows)

Steps to reproduce:

Run Kali Linux inside VirtualBox (reproduced in both Windowed and Fullscreen modes).Launch a persistent CLI process in the background terminal (e.g., cmatrix).Lock the screen via the upper-right session menu (activating xfce4-screensaver).Intentionally type an incorrect password once to trigger the login failure state.Press Ctrl + Esc on the keyboard (reproduced by pressing it twice in rapid succession).

Expected result:

The lock screen should remain active and continue prompting for the correct password.

Actual result:

The xfce4-screensaver interface completely disappears, immediately returning the user to the active desktop session and the running terminal.