https://husseinsaleh.com/Articles by Hussein Saleh: vulnerability write-ups on Meta, Instagram, Google and Anthropic, scam investigations and more.en-UShttps://husseinsaleh.com/2026/10/24/vulnerability-in-instagram-challenge-system-missing-rate-limit-causes-permanent-account-lockout-via-state-poisoning/https://husseinsaleh.com/2026/10/24/vulnerability-in-instagram-challenge-system-missing-rate-limit-causes-permanent-account-lockout-via-state-poisoning/Sat, 24 Oct 2026 05:57:02 GMTVulnerabilitiesA missing rate limit on Instagram's code_entry_async endpoint let attackers brute-force codes and poison verification state, locking owners out for good.https://husseinsaleh.com/2026/09/04/dissecting-the-tron-honeypot-scam-how-attackers-weaponize-native-multi-sig-permissions-to-trap-usdt-and-farm-gas-fees/https://husseinsaleh.com/2026/09/04/dissecting-the-tron-honeypot-scam-how-attackers-weaponize-native-multi-sig-permissions-to-trap-usdt-and-farm-gas-fees/Fri, 04 Sep 2026 07:35:55 GMTInvestigationsHow attackers weaponize TRON's native multi-sig permissions to trap USDT and farm gas fees with leaked seed phrases posted on social media.https://husseinsaleh.com/2026/07/25/vulnerability-in-instagram-followers-following-legacy-graphql-endpoint-leaks-hidden-lists-and-meta-verified/https://husseinsaleh.com/2026/07/25/vulnerability-in-instagram-followers-following-legacy-graphql-endpoint-leaks-hidden-lists-and-meta-verified/Sat, 25 Jul 2026 07:27:20 GMTVulnerabilitiesA BOLA flaw in Instagram's legacy GraphQL endpoint exposed hidden follower and following lists and bypassed Meta Verified follower limits.https://husseinsaleh.com/2026/06/13/session-isolation-bypass-in-claude-code-persistent-remote-tunnels-survive-account-switches-via-login/https://husseinsaleh.com/2026/06/13/session-isolation-bypass-in-claude-code-persistent-remote-tunnels-survive-account-switches-via-login/Sat, 13 Jun 2026 07:25:00 GMTVulnerabilitiesClaude Code's /login kept Remote Control tunnels open after switching accounts, leaving cross-account access alive. How it worked; patched in v2.1.176.https://husseinsaleh.com/2026/05/27/vulnerability-in-hostgator-oauth-state-injection-leaks-central-sso-tokens-via-postmessage/https://husseinsaleh.com/2026/05/27/vulnerability-in-hostgator-oauth-state-injection-leaks-central-sso-tokens-via-postmessage/Wed, 27 May 2026 06:53:00 GMTVulnerabilitiesChaining an unvalidated OAuth state origin with an insecure postMessage on HostGator's GatorHub enabled 1-click account takeover via leaked SSO tokens.https://husseinsaleh.com/2026/05/04/the-ghost-admin-bypass-hijacking-meta-portfolios-via-persistent-asset-sessions/https://husseinsaleh.com/2026/05/04/the-ghost-admin-bypass-hijacking-meta-portfolios-via-persistent-asset-sessions/Mon, 04 May 2026 08:08:44 GMTVulnerabilitiesA Meta Business Portfolio flaw keeps a removed admin's session alive through a connected Instagram asset, giving a hidden ghost admin full control.https://husseinsaleh.com/2026/04/09/vulnerability-meta-verified-support-impersonation/https://husseinsaleh.com/2026/04/09/vulnerability-meta-verified-support-impersonation/Thu, 09 Apr 2026 17:07:47 GMTVulnerabilitiesA Meta Verified logic flaw let attackers pull users into official Instagram Support chats, making their messages look like they came from Meta staff.https://husseinsaleh.com/2026/02/21/meta-account-quality-idor-business-sabotage/https://husseinsaleh.com/2026/02/21/meta-account-quality-idor-business-sabotage/Sat, 21 Feb 2026 09:59:11 GMTVulnerabilitiesAn IDOR in Meta Business Suite's mobile deep links exposes private ban details and lets strangers act on restricted Pages, sabotaging their appeals.https://husseinsaleh.com/2026/02/18/vulnerability-in-facebook-ad-accounts-delete-rejected-ads-via-instagram-web-to-bypass-policy-enforcement/https://husseinsaleh.com/2026/02/18/vulnerability-in-facebook-ad-accounts-delete-rejected-ads-via-instagram-web-to-bypass-policy-enforcement/Wed, 18 Feb 2026 06:43:00 GMTVulnerabilitiesA sync flaw let advertisers delete rejected ads from disabled Facebook Ad Accounts via Instagram web, wiping violation history before an appeal.https://husseinsaleh.com/2026/02/12/vulnerability-in-instagram-account-center-persistent-linked-sessions-enable-full-account-takeover-and-2fa-bypass/https://husseinsaleh.com/2026/02/12/vulnerability-in-instagram-account-center-persistent-linked-sessions-enable-full-account-takeover-and-2fa-bypass/Thu, 12 Feb 2026 08:41:10 GMTVulnerabilitiesA linked account in Instagram's Account Center kept full control of a main account even after password, email and 2FA changes, bypassing global logout.https://husseinsaleh.com/2026/01/05/vulnerability-in-mandiant-advantage-hardcoded-google-oauth-secret-enables-unauthorized-token-exchange/https://husseinsaleh.com/2026/01/05/vulnerability-in-mandiant-advantage-hardcoded-google-oauth-secret-enables-unauthorized-token-exchange/Mon, 05 Jan 2026 10:10:38 GMTVulnerabilitiesMandiant Advantage shipped its Google OAuth client secret in client-side JavaScript, letting attackers exchange tokens and impersonate the application.https://husseinsaleh.com/2025/10/14/vulnerability-in-instagram-private-accounts-collaborative-posts-discoverable-without-authorization/https://husseinsaleh.com/2025/10/14/vulnerability-in-instagram-private-accounts-collaborative-posts-discoverable-without-authorization/Tue, 14 Oct 2025 08:20:46 GMTVulnerabilitiesA flaw let anyone discover collaborative posts between private Instagram accounts and public ones, exposing private activity without following them.https://husseinsaleh.com/2025/06/10/vulnerability-in-meta-verified-accounts-change-name-and-username-without-review/https://husseinsaleh.com/2025/06/10/vulnerability-in-meta-verified-accounts-change-name-and-username-without-review/Tue, 10 Jun 2025 09:43:05 GMTVulnerabilitiesA flaw let Meta Verified accounts change their name and username without the required review, keeping the badge and opening the door to impersonation.https://husseinsaleh.com/2025/02/14/my-disappointing-experience-with-metas-bug-bounty-program-a-critical-2fa-vulnerability-that-went-nowhere/https://husseinsaleh.com/2025/02/14/my-disappointing-experience-with-metas-bug-bounty-program-a-critical-2fa-vulnerability-that-went-nowhere/Fri, 14 Feb 2025 16:50:43 GMTPostsI reported a critical 2FA vulnerability to Meta's bug bounty program. It was rejected, then marked duplicate. Here's what happened and what it means.https://husseinsaleh.com/2025/02/14/bypass-instagram-username-review-vulnerability-in-meta-verified-accounts/https://husseinsaleh.com/2025/02/14/bypass-instagram-username-review-vulnerability-in-meta-verified-accounts/Fri, 14 Feb 2025 15:34:36 GMTVulnerabilitiesHow a flaw in Meta Verified let Instagram accounts change their username instantly with no review, breaking the badge's protection against impersonation.https://husseinsaleh.com/2025/01/28/bypass-two-factor-authentication-in-meta-business-suite-to-hijack-facebook-pages/https://husseinsaleh.com/2025/01/28/bypass-two-factor-authentication-in-meta-business-suite-to-hijack-facebook-pages/Tue, 28 Jan 2025 18:23:56 GMTVulnerabilitiesA URL manipulation flaw in Meta Business Suite let attackers bypass two-factor authentication and take over Facebook Pages managed in Business Manager.https://husseinsaleh.com/2025/01/23/vulnerability-in-instagram-ip-center-how-i-spoofed-major-brands-via-unverified-emails/https://husseinsaleh.com/2025/01/23/vulnerability-in-instagram-ip-center-how-i-spoofed-major-brands-via-unverified-emails/Thu, 23 Jan 2025 09:44:00 GMTVulnerabilitiesAn Instagram Lite sync flaw let anyone file trademark and copyright reports from unverified brand emails, impersonating companies to remove content.https://husseinsaleh.com/2025/01/15/how-i-took-down-the-londonatak-store-scam/https://husseinsaleh.com/2025/01/15/how-i-took-down-the-londonatak-store-scam/Wed, 15 Jan 2025 13:54:02 GMTInvestigationsHow I investigated londonatak.store, a crypto-paid scam selling stolen cards and hacked accounts, traced its hosting and got the site taken down.https://husseinsaleh.com/2024/12/23/vulnerability-in-instagram-challenge-system-bypassing-the-locked-screen-via-url-manipulation/https://husseinsaleh.com/2024/12/23/vulnerability-in-instagram-challenge-system-bypassing-the-locked-screen-via-url-manipulation/Mon, 23 Dec 2024 08:57:00 GMTVulnerabilitiesA logic flaw in Instagram's Challenge system let a locked account's security code be redirected to any email through URL parameters, bypassing recovery.