# Meta Quest: Attacker could make any Oculus user to follow (subscribe) him without any approval

GraphQL follow-accept mutation on graph.oculus.com trusted client-supplied follow_requester_id, letting an attacker force any Oculus user to follow them without approval.

- Payout: $1,726
- Severity: medium
- Program: Meta / Facebook
- Credited: Dzmitry Lukyanenka
- Disclosed: 2023-01-09
- Write-up quality: 6/10
- Original: https://www.vulnano.com/2023/01/meta-quest-attacker-could-make-any.html
- Library page: https://bugbountylibrary.com/r/blog%3Avulnano-com-2023-01-meta-quest-attacker-could-make-any-html
- Tags: domain:web3 impact:integrity kind:bounty platform:blog sev:medium tech:graphql technique:param-pollution vuln:access-control vuln:business-logic vuln:idor

**Target:** GraphQL mutation OCAccountFollowRequestButtonsAcceptMutation on graph.oculus.com
**Root cause:** The accept-follow-request mutation took follow_requester_id from the request body and added the connection without verifying that the requester actually had a pending follow request to the victim.
**Steps:**
1. Enable follow-request confirmation on attacker account so a pending request exists from victim.
2. Capture `POST /graphql?locale=en_US` to `graph.oculus.com` with `X-Fb-Friendly-Name: OCAccountFollowRequestButtonsAcceptMutation`.
3. In `variables`, replace `follow_requester_id` value with any target Oculus ID.
4. Replay request; target user is added to attacker's followers without their approval.
**How found:** Researcher observed the confirm-follow request in the People page and noticed follow_requester_id was a client-controlled parameter, then substituted other valid Oculus IDs.
**Exploitation:** Attacker submits the accept mutation with an arbitrary victim Oculus ID in follow_requester_id, causing the victim to be subscribed to the attacker's account without consent, inflating follower counts shown on Quest devices and Meta Quest Android.
**Insight:** On GraphQL social-graph mutations, the actor/requester ID is often passed as a variable rather than derived from the session; swap it for other users' IDs to test whether the server validates a real pending relationship.