Amazon has recently patched a high-severity vulnerability in their Amazon Photos app on Android. The flaw in the app was originally brought to Amazon’s attention in November 2021 by researchers at Checkmarx, a cybersecurity firm headquartered in Israel. The researchers explained that this flaw could allow an attacker to steal a user’s Amazon access token, which is used to authenticate a user across multiple APIs. These APIs commonly contain personal data, such as a user’s name, email address, physical address, and more. Researchers compared this bug to sending a password to another application as plain text. Attackers could exploit this vulnerability to modify files while erasing a user’s history, preventing the files from being restored by the user and rendering them unrecoverable. Although the app was downloaded by more than 50 million people before the patch was released on December 18, 2021, the company has stated “no evidence that sensitive customer information was exposed as a result of this issue.” Checkmarx researchers state they found a number of ways a theoretical attacker could delete files in Amazon Drive, emphasizing that there were multiple ways that ransomware actors could take advantage of the flaw. The Vice President of Checkmarx stated, “seeing that kind of vulnerability in the software of Amazon, one of the leading companies in the world when it comes to security practices, means that it can happen to every software company.” This major flaw should serve as a staunch reminder that when it comes to security practices, no company is ever completely safe and must always stay vigilant.