Preliminary research

Leaking Meta FXAuth Token leading to 2-click Account Takeover

Youssef Sammouda · Youssef Sammouda (sam0) personal blog · 16 January 2026

AI-collected research leads through 2 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

A Meta FXAuth flow restricts redirect hosts but still accepts attacker-controlled legacy `apps.facebook.com` application namespaces. Redirected token and blob values can then complete account linking or action reauthentication without the normal confirmation step.

Record

Researcher

Youssef Sammouda

Published by

Youssef Sammouda (sam0) personal blog

Date

16 January 2026

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• oauth
• redirect
• token-theft
• auth-bypass
• account-takeover
• attack-chain
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Youssef Sammouda, first published at the original source. Preserved copies are kept so the citation survives its host.