Cybersecurity researchers from Trend Micro uncovered two critical authentication bypass vulnerabilities (CVE-2025-10643 and CVE-2025-10644, CVSS scores 9.1 and 9.4) in Wondershare RepairIt, an AI-powered data repair tool. The flaws stemmed from overly permissive cloud storage tokens embedded in the application’s code, granting read/write access to sensitive data—including user-uploaded images/videos, AI models, software binaries, source code, and container images—all stored unencrypted. Exploitation could enable attackers to bypass authentication, tamper with AI models or executables, and launch supply chain attacks via vendor-signed updates or malicious AI model downloads. The exposed data included customer private information, intellectual property (e.g., patents, source code), and proprietary AI models, risking intellectual property theft, regulatory penalties, and severe erosion of consumer trust. Trend Micro’s responsible disclosure via the Zero Day Initiative (ZDI) in April 2025 went unanswered, leaving users vulnerable. The incident highlights critical gaps in DevSecOps practices, where rushed innovation overlooked security implications, enabling potential large-scale abuse of user data and system integrity.