writeups.xyz / Oculus SSO “Account Linking” bug leads to account takeover on third party websites and inside VR Games/Apps

Submitter : c2a

Date: 20 May 2021

Bounty : 12,000

Vulnerabilities :

• SSO
• Broken Authentication
• Account Takeover

Programs :

• Meta / Facebook

Authors :

• Youssef Sammouda (@Samm0uda)

Link :
https://ysamm.com/?p=697