# How I Could Compromise 4% (Locked) Instagram Accounts

Unauthenticated checkpoint pages exposed locked Instagram accounts' email/phone update forms via IDOR, letting attackers rebind contact info and reset passwords to take over ~4% of accounts.

- Payout: $5,000
- Severity: high
- Program: Meta / Facebook
- Credited: Arne Swinnen
- Disclosed: 2016-03-27
- Write-up quality: 7/10
- Original: https://www.arneswinnen.net/2016/03/how-i-could-compromise-4-locked-instagram-accounts
- Library page: https://bugbountylibrary.com/r/blog%3Aarneswinnen-net-2016-03-how-i-could-compromise-4-locked-instagram-accounts
- Tags: domain:web impact:ato impact:data-leak kind:bounty platform:blog sev:high tech:rest technique:recon vuln:account-takeover vuln:auth-bypass vuln:idor

**Target:** Instagram account checkpoint / verification web pages (checkpoint_logged_out_main)
**Root cause:** Checkpoint pages that let users update email/phone for locked accounts lacked authentication, and were keyed by sequential numeric user id, enabling IDOR enumeration.
**Steps:**
1. Log in to a test account; get redirected to checkpoint_logged_out_main page with own user id in URL
2. Note page is reachable unauthenticated and keyed by incremental user id
3. Enumerate ids in range 2000000000-2001000000
4. Classify page variants: captcha, email/SMS verify, update email, update phone
5. For 'update phone' pages, submit a new phone number to rebind the victim account
6. Trigger SMS password reset to the newly linked number to take over the account
**How found:** Researcher logged into an old test account, was redirected to a verification page, and noticed the URL was 'checkpoint_logged_out_main' with his own user id — suggesting the page worked unauthenticated. He then enumerated a 1M id range to see what states other accounts were in.
**Exploitation:** Attacker enumerates sequential user ids against the unauthenticated checkpoint endpoint, identifies accounts in the 'update phone number' locked state, submits their own phone number to rebind it, then uses SMS password reset to gain full account access. Author did not perform actual takeover on live accounts due to responsible disclosure.
**Escalation:** Extrapolated 3.88% of a 1M id sample to ~20M of ~500M active accounts vulnerable; email-update variant (0.17%) offered same takeover path.
**Insight:** Checkpoint/verification/interstitial flows are often built as logged-out pages keyed by sequential ids; enumerate id ranges and diff the rendered page variants to find state-specific forms (email/phone update) that skip auth.