Meta AI Recovery Tool Flaw Exposed 20,000+ Instagram Accounts
ID: eca4d237-67be-593b-a55a-a056fc3f38fe
STIX ID: report--eca4d237-67be-593b-a55a-a056fc3f38fe
Feed Name: Security Affairs
Threat Score
A flaw in Meta’s AI-driven Instagram account recovery tool (HTS) allowed attackers to request password reset links to arbitrary emails without verifying ownership, enabling full account takeovers for users without 2FA; Meta reports 20,225 accounts were potentially compromised during exploitation from ~April 17 to early June 2026 and has disabled HTS, invalidated reset links, and forced security remediation.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.