Facebook Security Bug Affects 90M Users
Summary: Facebook disclosed a vulnerability in its "View As" feature that let attackers steal access tokens and potentially take over user accounts, prompting the company to reset tokens for 50 million accounts it knows were affected and another 40 million that may have been impacted over the past year. Facebook removed the insecure "View As" feature and said it was just beginning its investigation, without yet knowing whether accounts were misused, whether private information was accessed, or who was responsible.
What you should know: A Facebook spokesperson confirmed it was technically possible an attacker could have abused the bug against third-party apps and sites using Facebook logins, and said the company had invalidated data access for third-party apps for the affected 90 million accounts - a reminder that one token theft can reach every site that trusts the identity provider.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026