# Account Takeover

Facebook photo-import link carried a reusable token that let any user rebind a victim's linked Facebook account to the attacker's, enabling account takeover via FB login.

- Payout: hidden
- Severity: high
- Program: Bumble
- Found by: bugdisclose
- Disclosed: 2016-03-12
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/121827
- Library page: https://bugbountylibrary.com/r/h1%3A121827
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:oauth vuln:account-takeover vuln:auth-bypass

**Target:** Facebook photo-import OAuth/link flow on m.badoo.com
**Root cause:** The photo-import link contains a token that is not bound to the requesting user/session, so it can be replayed by any other user to replace their linked Facebook account with the token owner's.
**Steps:**
1. Create attacker and victim Badoo accounts, each linked to a different Facebook account.
2. As attacker, go to import photos via Facebook and copy the link from the URL bar.
3. As victim in a different browser, open the copied link and click cancel.
4. Victim's linked Facebook account is replaced with the attacker's Facebook account.
5. Log in via the attacker's Facebook account to be logged into the victim's Badoo account.
**How found:** Researcher noticed the FB photo-import URL contained a token and hypothesized it was not scoped to the generating user, then tested replaying it from a second account.
**Exploitation:** Attacker generates a photo-import link tied to their own Facebook account and delivers it to the victim; when the victim opens it (even cancelling), the victim's account is rebound to the attacker's FB identity. The attacker then authenticates via Facebook OAuth and lands in the victim's account.
**Insight:** OAuth/account-linking helper links that embed a token should be tested for cross-user replay: generate the link on account A, open it on account B, and check whether B's linked identity is overwritten rather than rejected.