Critical Flaw in Meta's Account Recovery Exposes User PII

On June 8, 2026, GoPlus revealed a critical design flaw in Meta's account recovery feature. This vulnerability allows attackers to access users' phone numbers, email addresses, and other personally identifiable information (PII) simply by entering a Meta username, without any login or verification. The flaw poses significant risks, including large-scale phishing attacks, SIM swap attacks, account takeovers, and identity theft. Users are advised to remove or change compromised recovery options, update passwords, enable two-factor authentication (2FA), and avoid suspicious communications. The exposure of sensitive information could lead to targeted social engineering attacks. The situation requires urgent attention from affected users to mitigate potential risks. No specific CVEs were mentioned in the articles.

Key Points: • Meta's account recovery feature has a critical design flaw exposing user PII. • Attackers can access sensitive information without any verification by using a username. • Users are advised to change recovery options and enable 2FA to protect their accounts.