# How I hacked Tinder accounts using Facebook’s Account Kit and earned $6,250 in bounties

Account Kit failed to bind OTP to phone number, and Tinder's login API didn't validate the token's client ID, enabling full account takeover via victim's phone number.

- Payout: $6,250
- Severity: critical
- Program: Tinder, Meta / Facebook
- Credited: Anand Prakash
- Disclosed: 2018-02-20
- Write-up quality: 7/10
- Original: https://medium.freecodecamp.org/hacking-tinder-accounts-using-facebook-accountkit-d5cc813340d1
- Library page: https://bugbountylibrary.com/r/blog%3Amedium-freecodecamp-org-hacking-tinder-accounts-using-facebook-accountkit-d5cc813340d1
- Tags: domain:api domain:web impact:ato impact:pii-leak kind:bounty platform:blog sev:critical tech:oauth technique:chained vuln:access-control vuln:account-takeover vuln:auth-bypass

**Target:** Account Kit phone-confirm API and Tinder /v2/auth/login/accountkit endpoint
**Root cause:** Account Kit's phone confirm endpoint did not verify that the OTP was issued for the submitted phone number, and Tinder's login API accepted any Account Kit access token without checking the client ID it was issued to.
**Steps:**
1. POST to `https://www.accountkit.com/update/async/phone/confirm/?dpr=2` with `_new_phone_number=<victim phone>`, attacker's own `update_request_code` and `confirmation_code`, `user=0&a=1`
2. Grab victim's `aks` access token from accountkit.com cookies
3. POST to `https://api.gotinder.com/v2/auth/login/accountkit?locale=en` with body `{"token":"<victim aks>","id":""}` and headers `platform: web`, `app-version: 1000000`
4. Session returned is authenticated as the victim
**How found:** Author noticed Tinder delegates phone login to Account Kit and that the Tinder API accepted the token without validating the client ID, then tested whether Account Kit's phone-confirm flow bound the OTP to the submitted number.
**Exploitation:** Attacker only needs the victim's phone number. They confirm their own OTP against the victim's number on Account Kit, obtaining a valid `aks` token bound to the victim, then replay it to Tinder's login endpoint which trusts any Account Kit token regardless of client ID, yielding full account access (private chats, PII, swiping).
**Insight:** When a target outsources auth to a third-party IdP, test whether the relying party validates the token's audience/client ID — a token minted for any other app on the same IdP may be accepted. Also probe whether OTP confirmation binds the code to the identifier or just to the session.