When Disconnecting Isn’t Enough: Instagram Messages Leak via Creator Studio

Affected Feature

Facebook Creator Studio's Instagram account linking system. Creator Studio lets you manage Instagram messages and comments from desktop by connecting your Instagram account to a Facebook Page.

How to Reproduce

Connect an Instagram account to a Facebook Page through Creator Studio
Use Creator Studio to manage that Instagram account's DMs and comments
Go to Facebook settings and disconnect the Instagram account from the Page
Go back to Creator Studio
You still have full access to read and reply to Instagram DMs and comments

The disconnection only removed the visible link. The backend authorization stayed active, so I could keep accessing everything like nothing changed.

Comments

When an AI Search Engine Forgot Who It Was: A Bug Report That Changed Perplexity AI’s Identity

Affected Feature Perplexity AI's conversational response system across both Chrome extension and mobile app. When users ask comparative questions about Perplexity itself, the system should respond from its own identity as a search engine. How to Reproduce Open Perplexity AI (Chrome extension or mobile app) Ask: "Are you better than Google?" The response compares ChatGPT to Google instead of Perplexity to Google Perplexity acts like it's ChatGPT, completely ignoring its own identity as a search engine Same bug happened on both the extension and app - identical confused responses about ChatGPT vs Google. Impact This is a product logic bug that creates an identity crisis. Users asking about Perplexity get answers about ChatGPT, making them think Perplexity is just a ChatGPT wrapper instead of its own search engine. The LLM powering Perplexity couldn't recognize that "you" in the question meant Perplexity itself. It associated "better than Google...

OpenAI Logout Glitch: When “Log Out of All Sessions” Didn’t Log Me Out

Affected Feature OpenAI's "Log out of all sessions" feature. This is supposed to sign you out from every device where you're logged in - web, mobile, everything. How to Reproduce Log into OpenAI on desktop browser and mobile app with the same account On desktop, click "Log out of all sessions" in account settings Wait about 30 minutes Open the mobile app You're still logged in - no re-authentication required Even force-closing and reopening the app doesn't trigger a logout The web session ends properly, but the mobile app session stays active even though you explicitly logged out everywhere. Company Response Reported via Bugcrowd. Marked as duplicate since another researcher found it first, but OpenAI confirmed and fixed the issue as of June 4, 2025.

Snapchat Public Profile Information Auto-Saves Without Confirmation

Affected Feature Public Profile editing section, specifically the email and location fields. This is where users manage what personal information appears on their publicly visible Snapchat profile. How to Reproduce Open Snapchat and go to your Public Profile Tap to edit your email or location Start typing something new Don't press the tick (✓) button Just back out or close the keyboard The app saves whatever you typed anyway, even though you never confirmed it.

Womuntio

Search This Blog