# IDOR User Account Takeover By Connecting My Facebook Account with victims Account

Facebook auth callback linking request trusted a client-supplied _user_id, letting an attacker link their Facebook login to a victim's account and take it over.

- Payout: unconfirmed
- Severity: high
- Program: Meta / Facebook
- Credited: Muhammad Khizer Javed
- Disclosed: 2018-09-16
- Write-up quality: 6/10
- Original: https://blog.securitybreached.org/2018/09/16/idor-account-takeover-using-facebook/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-securitybreached-org-2018-09-16-idor-account-takeover-using-facebook
- Tags: domain:web impact:ato kind:bounty platform:blog sev:high tech:oauth technique:recon vuln:account-takeover vuln:auth-bypass vuln:idor

**Target:** Facebook OAuth callback linking endpoint
**Root cause:** The /login/auth/facebook/callback linking flow accepted a client-controlled _user_id parameter and bound the authenticated Facebook identity to that account without verifying ownership.
**Steps:**
1. Create two accounts on target and observe _user_id values passed in requests
2. Identify the linking callback: `GET /login/auth/facebook/callback?linking=true&redirect_uri=https://target.com/account&_user_id=<User-ID>`
3. Replace _user_id with the victim's ID and send the request (200 OK)
4. Log in via Facebook; the attacker's Facebook account is now linked to the victim's account
5. Log in with Facebook to access the victim account without a password
6. Enumerate public endpoints; find victim _user_id leaked in S3 image URLs: `subdomain.target.com/media-uploads/<User-ID>/.../1.jpg`
**How found:** Noticed the site identified users by a unique _user_id; created multiple accounts to trace where the parameter was passed, found it in the Facebook auth callback linking request, and tested swapping it with another test account's ID.
**Exploitation:** Attacker obtains victim _user_id (leaked in S3-hosted image URLs), sends the linking callback with victim's _user_id while authenticated to their own Facebook account, then logs in via Facebook to gain full access to the victim's account with no password.
**Escalation:** Escalated from a low-priority IDOR by finding a public leak of the otherwise-unique _user_id in S3 image URLs, making the attack practical.
**Insight:** OAuth 'linking' callbacks that take an account identifier as a request parameter are prime IDOR targets; when the identifier looks unguessable, hunt for it leaking in CDN/S3 media paths, avatar URLs, or other public object keys.