Security researcher Rony K Roy received a $78,000 bug bounty from Meta after discovering a critical vulnerability in Meta's backend support infrastructure, initially identified in January 2026. The flaw combined missing authorization, broken access control, and IDOR issues that, when chained together, could have allowed attackers to access sensitive customer support data, including emails, chat logs, and personal information shared with Meta support. Meta patched the vulnerability in April 2026 and found no evidence of malicious exploitation prior to the fix.
