# Subscribe to typing notifications for any Instagram user

Instagram MQTT DirectTypingSubscription accepted arbitrary user_id, letting any user subscribe to another user's typing notifications in DMs.

- Payout: $10,750
- Severity: medium
- Program: Meta / Facebook
- Credited: Philippe Harewood
- Disclosed: 2019-07-21
- Write-up quality: 6/10
- Original: https://philippeharewood.com/subscribe-to-typing-notifications-for-any-instagram-user/
- Library page: https://bugbountylibrary.com/r/blog%3Aphilippeharewood-com-subscribe-to-typing-notifications-for-any-instagram-user
- Tags: domain:web3 kind:bounty platform:blog sev:medium tech:graphql tech:websocket technique:source-review vuln:access-control vuln:idor

**Target:** Instagram MQTT realtime DirectTypingSubscription GraphQL endpoint
**Root cause:** The DirectTypingSubscription GraphQL subscription trusted the client-supplied user_id without verifying it matched the authenticated account, so any user could subscribe to another user's typing events.
**Steps:**
1. Obtain target IG user ID via `view-source:https://www.instagram.com/USERNAME/` and grep `profilePage_`.
2. Patch `DirectTypingSubscription.php` line 20: `'user_id' => $accountId` to `'user_id' => 'IGID'`.
3. Run `php realtimeClient.php` with attacker credentials (bypass checkpoint via device_id/phone_id from login response).
4. Have a third user type in a DM to the target; observe MQTT patch event with sender_id and thread id.
**How found:** Researcher inspected the instagram-php library's DirectTypingSubscription and noticed user_id was a client-controlled parameter, hypothesizing it wasn't bound to the authenticated session.
**Exploitation:** Attacker authenticates as themselves, edits the subscription payload to set user_id to the victim's IG ID, and connects to MQTT. Any typing activity directed at the victim is delivered to the attacker's subscription, revealing sender_id, thread id, and timestamps.
**Insight:** Realtime/MQTT subscription payloads often carry a user_id or channel identifier that the server trusts; try swapping it for a victim's ID to receive their events.