# Full account takeover

Reverb's iOS Facebook login endpoint accepted any app's Facebook access token, letting an attacker log in as any user via their own app token.

- Payout: hidden
- Severity: high
- Program: Reverb.com
- Found by: sandeep_hodkasia
- Disclosed: 2020-03-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/314808
- Library page: https://bugbountylibrary.com/r/h1%3A314808
- Tags: area:mobile domain:api domain:mobile impact:ato impact:mass-exploit kind:bounty platform:hackerone sev:high tech:oauth vuln:account-takeover vuln:auth-bypass

**Target:** POST /api/auth/facebook login endpoint (iOS app)
**Root cause:** The server-side login API did not validate the Facebook access_token's audience/app, accepting tokens issued to any other Facebook app.
**Steps:**
1. Obtain a Facebook access token issued to a different app (e.g. Lyst app token).
2. Send `POST /api/auth/facebook` with body `{"fb_token":"<token>"}`.
3. Server accepts the foreign-app token and authenticates the corresponding user.
**How found:** Noticed the iOS login flow trusted a client-supplied Facebook token and tested substituting a token from a different app.
**Exploitation:** Attacker uses their own Facebook app's access token in the fb_token field of the login request to authenticate as the token's owner, taking over any account.
**Insight:** For social-login endpoints, test whether the server validates the token's app/audience (Facebook debug_token app_id check) by replaying a token minted for an unrelated app.