{"id":10147,"date":"2026-01-26T10:04:17","date_gmt":"2026-01-26T10:04:17","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/01\/26\/new-instagram-vulnerability-exposes-private-posts-to-anyone\/"},"modified":"2026-01-26T10:04:17","modified_gmt":"2026-01-26T10:04:17","slug":"new-instagram-vulnerability-exposes-private-posts-to-anyone","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/01\/26\/new-instagram-vulnerability-exposes-private-posts-to-anyone\/","title":{"rendered":"New Instagram Vulnerability Exposes Private Posts to Anyone"},"content":{"rendered":"

New Instagram Vulnerability Exposes Private Posts to Anyone
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A critical server-side vulnerability in Instagram\u2019s infrastructure allowed unauthenticated attackers to access private photos and captions without a login or follower relationship, according to a disclosure released this week by security researcher Jatin Banga.<\/p>\n

The vulnerability, which was reportedly patched silently by Meta in October 2025, relied on a specific configuration of HTTP headers to bypass privacy controls on the mobile web interface.<\/p>\n

The \u201cPolaris\u201d Exploit Mechanism<\/strong><\/h2>\n

The vulnerability stemmed from a failure in Instagram\u2019s server-side authorization logic rather than a simple caching error. Banga discovered that sending an unauthenticated GET<\/em> request to instagram.com\/<private_username><\/em> with specific mobile user-agent headers triggered a response containing the polaris_timeline_connection<\/em> JSON object.<\/p>\n

\"Private
Private post expose claim<\/figcaption><\/figure>\n

Under normal circumstances, this object should be empty or restricted for private accounts viewed by non-followers. However, for affected accounts, the server returned a full edges<\/em> array containing direct Content Delivery Network (CDN) links to private media and their associated captions.<\/p>\n

Exploit Workflow:<\/strong><\/p>\n

    \n
  1. \nRequest:<\/strong> Attacker sends a header-manipulated GET<\/em> request to a private profile.<\/li>\n
  2. \nResponse:<\/strong> Server returns HTML with embedded JSON data.<\/li>\n
  3. \nExtraction:<\/strong> The polaris_timeline_connection<\/em> object is parsed to locate the edges<\/em> array.<\/li>\n
  4. \nAccess:<\/strong> High-resolution images and post details are accessed via the exposed CDN URLs.<\/li>\n<\/ol>\n

    This \u201cconditional\u201d bug did not affect every account. In testing, approximately 28% of authorized test accounts were vulnerable, while others returned secure responses, suggesting a specific backend state or \u201ccorrupted\u201d session handling was required to trigger the leak.<\/p>\n

    Timeline of a Silent Patch<\/strong><\/h2>\n

    The disclosure outlines a contentious 102-day interaction with Meta\u2019s bug bounty program<\/a>. Banga submitted the initial report on October 12, 2025, including a Proof-of-Concept (PoC) script and video evidence.<\/p>\n

    \n
    \n