Summary
On September 28, 2018 Facebook disclosed that attackers had stolen access tokens by exploiting its View As feature; an initial estimate of nearly 50 million affected accounts was revised on October 12, 2018 to about 30 million whose tokens were actually stolen (roughly 29 million had data accessed). The root cause was a business-logic flaw chaining three bugs in the read-only View As profile preview: a video-uploader composer added in July 2017 wrongly appeared in that view, it incorrectly minted an access token at all, and critically it minted the token for the user being viewed rather than the viewer, embedding that token in the page HTML. An attacker could therefore select View As a target and scrape a fully privileged token for the target account, then pivot through friend lists to harvest tokens outward from roughly 400,000 seed accounts. The flaw is an improper-authentication / business-logic failure where an auth credential was generated in the wrong context and scoped to the wrong principal.
How to avoid it in your code
- Ensure read-only views and previews issue no session or access tokens; gate token minting to explicit authenticated actions only.
- Always scope generated tokens to the requesting principal, never to an identity supplied by the client.
- Never embed access tokens in rendered HTML or other client-readable response bodies.
- Security-test feature interactions, not just features in isolation; combined flows create logic flaws unit tests miss.
- Add anomaly detection on token issuance and friend-graph traversal to catch automated harvesting.
References
Related vulnerabilities
All AppSec →- CRITICALAPPSEC-NOAUTH-2023
nOAuth, disclosed by Descope's security team on June 20, 2023 (reported to Microsoft on April 11, 2023), is a cross-tenant account-takeover class in multi-tenant Microsoft Entra ID (Azure AD) OAuth applications, mapping to OWASP API2:2023 Broken Authentication. The flaw existed because Entra ID emitted an 'email' claim in the OIDC token that was both mutable and unverified, while applications used that email rather than the immutable 'sub'/'oid' claim to identify and link the signed-in user. An attacker who controlled their own Entra tenant could set the email attribute of an attacker account to a victim's email address, then use 'Log in with Microsoft' against any vulnerable app; the app merged accounts by the spoofed email and granted full control of the victim's account, requiring no interaction from the victim. Descope confirmed real exposure in major SaaS apps including a design platform with millions of monthly users. Microsoft mitigated by no longer emitting unverified email claims by default for app registrations created after June 2023 and added the xms_edov claim and a RemoveUnverifiedEmailClaim flag.
- CRITICALAPPSEC-COINBASE-TRADE-LOGIC-2022
In February 2022, a researcher known as Tree of Alpha reported a business-logic flaw in Coinbase's Retail Advanced Trading API through HackerOne, earning a $250,000 bounty that Coinbase described as its largest ever. Coinbase stated the underlying cause was a missing logic validation check in a Retail Brokerage API endpoint that allowed a user to submit trades to a particular order book using a mismatched source account. Because the order-validation logic never verified that the named source account actually held the asset being sold, a user could place sell orders for a cryptocurrency they did not own; the reproduction example sold one asset while sourcing it from an account holding a different token. This maps to OWASP API6:2023 Unrestricted Access to Sensitive Business Flows, an improper-validation business-logic error rather than a missing cryptographic or session control. Coinbase reproduced the bug, halted retail advanced trading into cancel-only mode within an hour of the report, and validated a patch the same day.
- MEDIUMAPPSEC-PELOTON-API-2021
On May 5, 2021 Pen Test Partners researcher Jan Masters and TechCrunch publicly disclosed that Peloton's API exposed the private account data of its users, having been reported privately to Peloton on January 20, 2021. The API had endpoints, including a workout-details POST endpoint, a user-search GET endpoint, and GraphQL endpoints, that performed no authorization checks: unauthenticated requests returned account data such as user IDs, location/city, age, gender, weight, workout statistics, birthday, and group/studio attendance, even for users who had set their profiles to private, because the privacy flag was not enforced at the API layer. This is a missing/insufficient-authorization flaw on an API serving over 3 million subscribers' data. A partial fix on February 2, 2021 only restricted the API to authenticated Peloton members, so anyone willing to create an account could still pull any other user's private data until the full fix around early May.
- HIGHAPPSEC-INSTAGRAM-OTP-BRUTEFORCE-2019
In 2019, researcher Laxman Muthiyah found an account-takeover flaw in Instagram's mobile password-recovery flow, which Facebook rewarded with a $30,000 bounty, mapping to OWASP API4:2023 Unrestricted Resource Consumption combined with broken authentication. The flow sent a six-digit recovery code to the user's phone, giving only 1,000,000 possible values, and its rate limiting was insufficient to stop high-volume guessing. Muthiyah observed that of 1,000 codes submitted from one IP, about 250 were processed while the rest were throttled, so per-IP limits alone did not cap total attempts. By combining a race condition with IP rotation, he sent roughly 200,000 concurrent requests from 1,000 different IP addresses and estimated about 5,000 IPs would suffice to cover the full code space within the 10-minute validity window, brute-forcing the code and taking over any account. The core defect was the absence of an effective global lockout tying failed attempts to the targeted account rather than only the source IP.
- MEDIUMAPPSEC-SOURCEMAP-DISCLOSURE
A source map (.map) is a build artifact that maps minified bundle code back to the original source, and bundlers embed the full original code in its sourcesContent field. Left reachable in production or shipped inside a package, it hands anyone the unminified codebase, internal comments, hidden API endpoints, auth logic, and any secrets that were compiled in. Discovery is trivial: open DevTools and read the Sources tab, request the bundle's .map URL directly, or Google-dork for ext:map intext:webpack, then reconstruct the whole project with a tool like unwebpack-sourcemap. Passive scanners such as Acunetix and Burp already flag it as a standalone finding. It is usually rated medium on its own but escalates fast when the recovered source contains live credentials or undocumented endpoints; exposed Webpack source maps have leaked hardcoded Stripe secret keys that enabled unauthorized payments. High-profile cases include Apple's App Store web front-end in November 2025, shipped with source maps still enabled, and Anthropic's Claude Code, whose entire TypeScript source leaked via a source map left in a published npm package in March 2026.
- HIGHAPPSEC-GRAPHQL-ABUSE
GraphQL servers expose three abuse primitives stemming from the query language's flexibility. Leaving introspection enabled lets any client send a __schema query and recover the entire type system, including internal admin mutations and deprecated fields, providing a map of the attack surface (OWASP API8/API2). Because per-request rate limiters count one HTTP request regardless of operations inside it, an attacker can use field aliasing (e.g. attempt0:login(...), attempt1:login(...)) or array batching to pack dozens of login or verifyOtp mutations into a single request, brute-forcing credentials or short OTP/2FA codes while the rate limiter sees only one request; this aliasing-bypass technique is reproduced in the PortSwigger Web Security Academy 'Bypassing GraphQL brute force protections' lab and Wallarm's GraphQL batching research. Deeply nested or recursive queries cause an exponential explosion of resolver and database calls, exhausting CPU, memory and connection pools for denial of service, the core of OWASP API4:2023 Unrestricted Resource Consumption. HackerOne has disclosed a real GraphQL authentication-bypass finding, and Apollo Server v4 disabled array batching by default in response to these attacks.