pentester.land· Feb 5, 2022· by abdellah yaala (@yaalaab)💰 Bounty: 7,500

Facebook Oauth bypass

Target Program: Meta / Facebook

🎯 Vulnerability: OAuth 2.0 / JWT Authentication Bypass

💡 Defense Fix: Strictly verify JWT signatures on the backend, enforce state parameter validation, and reject 'alg: none'.

#OAuth