Instagram Patches Flaw Exposing User Emails and Phone Numbers

Key Takeaways

• A critical logic bug in Instagram’s web password reset flow exposed users’ full email addresses and phone numbers.
• The vulnerability allowed unredacted contact information to be displayed during the account recovery process.
• Meta, Instagram’s parent company, deployed an emergency hotfix within hours of the public disclosure on June 6, 2026.
• While Meta confirmed no widespread data breach, the exposure heightened risks for phishing and account takeover.

Instagram Patches Critical Flaw Exposing User Contact Data in Password Reset Flow

A significant logic flaw within Instagram’s web-based password reset mechanism briefly exposed the complete email addresses and phone numbers of users, according to public disclosures and subsequent confirmation from Meta. The vulnerability, which surfaced on June 6, 2026, allowed attackers to view sensitive contact information that should have been partially redacted during the account recovery process.

Vulnerability Details and Disclosure

The core of the issue lay in the Instagram web interface’s password reset function. When a user initiated a standard password reset for a known username, the system’s response included fully visible email addresses and associated phone numbers. This directly contradicted Instagram’s usual practice of obscuring such details (e.g., m***@fb.com), which is designed to protect user privacy.

Security researchers publicly demonstrated the flaw on June 6, 2026. Proof-of-concept screenshots, widely circulated by security community accounts like @vxunderground on X, clearly showed unredacted contact information for various accounts, including prominent ones such as “zuck.” This direct exposure of personal data raises concerns regarding Meta’s adherence to its own data minimization policies and potentially Article 25 of GDPR, which mandates privacy by design.

Rapid Response and Broader Implications

Meta, Instagram’s parent company, acted swiftly to address the vulnerability. Within hours of the public demonstrations going viral, an emergency hotfix was deployed. Security researcher @Scot0xo confirmed on X that the flaw was indeed a logic bug within the web reset flow, rather than an API credential leak or a server-side breach. Meta officially acknowledged the patch, stating, “We fixed an issue that allowed an external party to request password reset emails for some Instagram users. There was no breach of our systems.”

While Meta asserted that no widespread data exfiltration occurred, even temporary exposure of unredacted account recovery data carries substantial risks. Adversaries could leverage this information for targeted phishing campaigns, SIM-swapping attacks, or direct account takeover attempts. Furthermore, the ability to enumerate multiple email addresses linked to a single Instagram account could aid attackers in mapping a target’s digital footprint across various online services.

A Pattern of Security Incidents

This incident is not isolated, marking the latest in a series of security challenges faced by Instagram in 2026. Earlier in January, a similar vulnerability in the password reset process enabled third parties to trigger mass reset emails, coinciding with reports of 17.5 million Instagram user records appearing on dark web forums. In early June, threat actors exploited a separate flaw in Meta’s AI-powered support chatbot, using prompt injection to compromise high-profile accounts, including the White House archive page and U.S. Space Force accounts, by manipulating the bot into linking target accounts to attacker-controlled email addresses.

Some security researchers attribute the increasing frequency of these failures to architectural decisions involving AI-driven automation of sensitive account functions. They argue that granting AI systems privileged access to account recovery mechanisms without robust identity verification introduces systemic risks. As of the time of publication, Meta has not disclosed a CVE identifier for this specific logic flaw.

What You Should Do

• Enable Multi-Factor Authentication (MFA): Ensure MFA is active on your Instagram account and all other online services to add an essential layer of security beyond just a password.
• Be Vigilant Against Phishing: Exercise extreme caution with any unsolicited emails or messages, especially those claiming to be from Instagram or Meta, and never click suspicious links.
• Monitor Account Activity: Regularly review your Instagram login activity and linked devices for any unauthorized access.
• Update Contact Information: Ensure your recovery email addresses and phone numbers are current and secure, as these are critical for legitimate account recovery.
• Report Suspicious Behavior: If you notice any unusual activity on your account or receive suspicious password reset requests, report them immediately to Instagram.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.