A recent security vulnerability on Instagram briefly exposed the private photos and captions of some users without requiring login or account following, according to a report by independent security researcher Jatin Banga. The flaw has since been addressed and fixed by Meta Platforms.
Details of the Security Issue
Banga explained that the vulnerability stemmed from a weakness in Instagram’s server-side authorization checks on its mobile web interface. Under certain conditions, a crafted web request, combined with specific mobile browser headers, could retrieve data intended for private accounts. Instead of blocking such access, Instagram’s servers sometimes returned backend data, including direct links to private photos and videos stored on Meta’s content delivery network, along with their captions. Notably, this did not require the requester to be logged in.
Scope of the Exposure
The flaw did not impact all private profiles. During testing, approximately 28% of sampled private accounts were found to be vulnerable, while others remained protected. This inconsistent behavior suggested the issue was tied to specific backend states or session handling, making it more difficult to detect and potentially more dangerous.
Meta’s Response
Banga reported the vulnerability to Meta on October 14, 2025. Following his discovery, Meta responded quickly, developing a fix within several days. The company later marked the issue as resolved, stating it was addressed through broader infrastructure updates rather than a targeted patch.
Current Status and Concerns
According to current assessments, the flaw is no longer exploitable. However, Banga emphasized the importance of improving bug detection and resolution processes, especially for issues affecting only certain users. The incident highlights a broader concern: private social media settings do not guarantee complete protection, and security relies heavily on the efforts of independent researchers who identify vulnerabilities that automated systems may overlook.