A security researcher has discovered a Facebook password reset vulnerability that allowed him to brute force into any FB account. Facebook acknowledged the issue promptly, fixed it and rewarded the researcher $15,000 USD. Facebook sends a 6 digit code on a users phone number or email address to reset their password. After you enter this code in the window, you are able to access your FB account and reset the password. The vulnerability could be exploited by attackers to hack into any Facebook account launching a brute force attack.”]
Source: http://securityaffairs.co/wordpress/45123/hacking/hacking-fb-account.html