Barely a month after winning $30,000 from Facebook for spotting a flaw in Instagram, Chennai-based security researcher Laxman Muthiyah on Monday said he again discovered a new account takeover vulnerability on the photo and video-sharing app. This time he has won $10,000 as part of the social network's bug bounty programme.
The new vulnerability that Mr Muthiyah spotted was similar to the one he reported in July and allowed anyone to hack Instagram accounts without consent permission.
-
-
"World That Relied On India's Brainpower Now Trusts Its Mindpower": PM Modi -
India Targets 2-3nm Chip Design As Students Develop Over 325 Chips, Says PM Modi -
'Viksit Bharat Not Just For Us': PM Modi At NDTV World Summit 2026 -
"World That Relied On India's Brainpower Now Trusts Its Mindpower": PM Modi -
"Some Dreaming Of Disorder": PM's "Failed Product Of Congress" Jibe At Rahul Gandhi -
PM Modi's Full Speech At NDTV World Summit 2026 -
Non-Oil Trade With India Went Up 50% In 3 Years: UAE Minister At NDTV Summit -
"Some Dreaming Of Disorder": PM's "Failed Product Of Congress" Jibe At Rahul Gandhi -
'Viksit Bharat Not Just For Us': PM Modi's Top Quotes At NDTV World Summit -
Has Indian Cuisine Arrived At The Global Stage? What Vir Sanghvi Believes
Facebook has now fixed the vulnerability that Laxman Muthiyah reported.
"Facebook and Instagram security team fixed the issue and rewarded me $10000 as a part of their bounty programme," Mr Muthiyah said in a blog post.
He found that the same device ID - the unique identifier used by Instagram server to validate password reset codes - can be used to request multiple pass codes of different users.
He showed that this vulnerability can be exploited to hack Instagram accounts.
"You identified insufficient protections on a recovery endpoint, allowing an attacker to generate numerous valid nonces to ten attempt recovery," Facebook said in a letter to Muthiyah.
Track Latest News Live on NDTV.com and get news updates from India and around the world
