Root cause
Recovery challenge state did not maintain sufficiently strict binding among account, device context, and verification secret. Review challenge ownership and uniqueness throughout the recovery lifecycle.
Demonstrated impact
Researcher reports a separate, lower-severity account-takeover finding, fixed before publication.
Lessons for review
- Bind recovery attempts and verification state to the intended account.
- Use atomic security counters and test concurrent state transitions locally.
Award and evidence
Individual finding, distinct from the researcher’s other Instagram recovery report; no additional bonus is counted. The primary article states $10000 without naming the currency. USD is a contextual inference from source-3, Facebook’s official 2019 program retrospective published February 7, 2020, roughly six months after the August 25, 2019 original article publication. The retrospective reports program-wide amounts in USD; it does not independently establish the denomination or settlement of this individual award. Exact award/payment dates remain unknown.
Re-read the primary article award statement and Facebook’s official 2019 program retrospective for contextual currency evidence. Existing publication chronology retained. No target testing performed.
- The current 2024 article header is not the original disclosure date
- Exact report, fix, and award dates are unavailable
- No independent vendor-hosted payout confirmation retrieved
- Current article update: 2024-12-06; original publication is stored separately.
- USD is inferred from later program-wide context (source-3), not explicitly stated by the individual award source; neither individual denomination nor cash settlement is independently confirmed.
Recorded timeline
- Published
- 2019-08-25explicit · Original publication date preserved by the author’s archive; current article header is a later update.
Related visual models
Recovery must preserve account ownership
Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.
Sources and provenance
- Instagram recovery challenges were insufficiently bound to accounts Laxman Muthiyah · reviewed 2026-10-03
- Original publication archive Laxman Muthiyah · reviewed 2026-10-02
- Facebook 2019 Bug Bounty retrospective — contextual USD denomination only Dan Gurfinkel / Facebook · reviewed 2026-10-03
Record reviewed 2026-10-03. Snapshot d5550c789111. Open the complete JSON contract.