writeups.xyz / Facebook account takeover due to a bypass of allowed callback URLs in the OAuth flow

Submitter : c2a

Date: 1 April 2021

Bounty : 12,000

Vulnerabilities :

• Account Takeover
• OAuth
• Open Redirect

Programs :

• Meta / Facebook

Authors :

• Youssef Sammouda (@Samm0uda)

Link :
https://ysamm.com/?p=646