# React debug.keystore key was trusted by Meta(Facebook) which caused to Instagram account takeover by malicious apps.

Facebook OAuth dialog validated only android_key signature, not package name; signing a malicious app with React Native's public debug.keystore let it obtain Instagram tokens silently.

- Payout: $12,000
- Severity: high
- Program: Meta / Facebook
- Credited: Dzmitry Lukyanenka
- Disclosed: 2022-07-19
- Write-up quality: 8/10
- Original: https://www.vulnano.com/2022/07/react-debugkeystore-key-was-trusted-by.html
- Library page: https://bugbountylibrary.com/r/blog%3Avulnano-com-2022-07-react-debugkeystore-key-was-trusted-by-html
- Tags: domain:api domain:mobile impact:ato kind:bounty platform:blog sev:high tech:android tech:oauth technique:recon technique:source-review vuln:access-control vuln:auth-bypass

**Target:** Facebook Android SDK OAuth dialog (m.facebook.com/dialog/oauth)
**Root cause:** The OAuth dialog validated only the android_key (app signature) and not the calling package name, so any app signed with a trusted key could impersonate the legitimate app. Instagram's Facebook app config trusted the publicly exposed React Native debug.keystore key.
**Steps:**
1. Read Facebook Android sources, find constant `fbandroid_debug` with android_key `Xo8WBi6jzSxKDVR4drqm84yr9iU` and signature hash.
2. Search the android_key value online, find it is the React Native debug.keystore at github.com/facebook/react-native/tree/master/keystores.
3. Sign a malicious APK with that debug.keystore.
4. Install Facebook for Android and log in with an account linked to Instagram.
5. Launch malicious app; it opens `https://m.facebook.com/dialog/oauth?android_key=Xo8WBi6jzSxKDVR4drqm84yr9iU&calling_package_key=com.vulnano.android.facebook.sdkat&client_id=124024574287414&redirect_uri=fbconnect://success&response_type=token,signed_request&scope=email`.
6. Receive Instagram OAuth token via fbconnect redirect without user interaction.
**How found:** While playing with the Facebook Android SDK, noticed the OAuth call validates android_key but not package name. Reading Facebook source found the `fbandroid_debug` key constant, searched the android_key value online, and discovered it matched the public React Native debug.keystore.
**Exploitation:** Attacker signs a malicious Android app with the public React Native debug.keystore, then triggers the Facebook OAuth dialog with Instagram's client_id and the trusted android_key. Because package name is not validated, Facebook returns an Instagram access token to the attacker's app, enabling account takeover without user interaction.
**Escalation:** Notes the same signature trust may bypass signature checks in IPC with Facebook apps or on Portal/Oculus devices.
**Insight:** When an OAuth/IPC flow trusts an app signature, check whether the signature key is a public debug/example keystore shipped in open-source repos; grep SDK source for hardcoded key constants and search their values online to find the matching keystore.