Amazon patches a critical vulnerability in the Android Photos app

Amazon has patched a flaw in its Android Photos app that could have allowed attackers to access sensitive data.

The flaw is caused by an incorrectly configured app component that is accessible without authentication.

An external app could easily trigger the vulnerable activity and send the token to an actor-controlled server at will.

Because the same token may be used by other Amazon APIs such as Prime Video, Alexa, Kindle, and so on, the exploitation potential is extensive.