Instagram Patches Account Recovery Flaw Leaking User Contact Information
ID: d088b9d7-d171-57b1-af8e-cd812786551e
STIX ID: report--d088b9d7-d171-57b1-af8e-cd812786551e
Feed Name: GBHackers
Threat Score
A critical frontend logic flaw in Instagram’s web-based account recovery exposed unredacted email addresses and phone numbers to unauthenticated users (including high-profile accounts), with PoC screenshots circulating; Meta patched the issue on June 6, 2026 and stated no backend breach, but exposed contact data raises phishing, credential-stuffing, SIM-swap and reconnaissance risks.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.