vxssroott/cve-2026-78905-facebook-account-takeoverSocial Media Infrastructure Vulnerability Research. CVE-2026-78905: OAuth token reuse and session hijacking in Facebook's Graph API.
| Field | Value |
|---|
| Severity | 9.6 (Critical) |
| Vector | Network |
| Affected Versions | Graph API v18.0 – v20.0 |
| Discovered By | 𝕍𝕠𝕤𝕤🥷 |
A critical vulnerability in Facebook's Graph API allows an attacker to reuse OAuth tokens across multiple sessions. This enables session hijacking and account takeover without requiring user interaction.
The Graph API does not enforce strict session binding for OAuth tokens. Once a token is issued, it can be reused from any device or location until it expires. This allows an attacker who captures a token (via phishing, network sniffing, or malware) to impersonate the victim indefinitely.
