writeups.xyz / Account takeover of Instagram accounts due to unrestricted permissions of third-party application’s generated tokens

Submitter : c2a

Date: 5 May 2021

Bounty : 18,000

Vulnerabilities :

• OAuth
• Broken Authorization
• Account Takeover

Programs :

• Meta / Facebook

Authors :

• Youssef Sammouda (@Samm0uda)

Link :
https://ysamm.com/?p=684