A Bug Hunter name Manjesh S from India, reported to Facebook Security Team on Instagram Account takeover through bruteforce, He was able to bruteforce an Instagram account through Facebook.
The reason for the attack can be said due to Instagram weak password policies which allows Burteforcing of accounts.
How Was He Able To Perform The Attack
Manjesh was able to do so in Facebook subdomain lookaside.facebook.com which he tries to connect his Instagram account with Facebook for advertising on Instagram, What he did was trying to login with incorrect Username And Password, Then he captured the request with Burpsuit and loaded his Payloads.
He then contacted the Facebook Security Team on May 6 which they were unable to reproduce the attack, He then send a Video Proof of Concept about the attacking scenario which was later fixed by them.
Did You Want to know how much he was awarded for this Bug :), He was awarded $5000 for finding this bug. Here is a screenshot from Facebook about them paying him.
Also This Is The Video POC For other Penetration Tester to learn from