A brute-force attack vulnerability was discovered in Oculus identity verification during username changes, where the lack of rate limiting allowed an attacker to enumerate 6-digit OTP codes and distinguish valid codes from invalid ones by analyzing response length differences (840 bytes for valid, 1152 for invalid).
Detailed walkthrough of exploiting blind SQL injection in Oculus' developer portal by bypassing multiple filters (no whitespace, no commas) using comment syntax and MySQL alternative function syntax, ultimately extracting admin session tokens and gaining administrative access.
A chained CSRF vulnerability in Oculus-Facebook account linking allowed attackers to connect victims' Facebook accounts to attacker-controlled Oculus accounts, extract first-party Facebook access tokens via GraphQL queries, and achieve complete account takeover including password reset. The vulnerability required multiple fixes after initial attempts could be bypassed using a second CSRF on the Oculus login flow.