writeups.xyz / Bad regex used in Facebook Javascript SDK leads to account takeovers in websites that included it

Submitter : c2a

Date: 31 December 2020

Bounty : 21,000

Vulnerabilities :

• Account Takeover
• HTTP Parameter Pollution
• PostMessage

Programs :

• Meta / Facebook

Authors :

• Youssef Sammouda (@Samm0uda)

Link :
https://ysamm.com/?p=510