writeups.xyz / Missing rate-limiting. How I was able to add any unowned phone number to my Facebook account? (Bounty: 5000 USD)

Submitter : c2a

Date: 31 January 2022

Bounty : 5,000

Vulnerabilities :

• OTP Bruteforce
• Lack of Rate Limiting

Programs :

• Meta / Facebook

Authors :

• Shubham Bhamare (@Theshubh77)

Link :
https://theshubh77.medium.com/write-up-missing-rate-limiting-how-i-was-able-to-add-any-unowned-phone-number-to-my-fb-account-fe4d7e67cf10