Spot the reentrancy bug

What is the main problem in this withdraw function?

function withdraw() external {
    uint256 amount = balances[msg.sender];
    (bool ok, ) = msg.sender.call{value: amount}("");
    require(ok, "fail");
    balances[msg.sender] = 0;
}