The broken assumption is that account recovery is safer than login. Here, the reset channel itself handed out access when the destination email was not tied to the account, so changing the password could become the attacker's way in if 2FA was off.
Meta says it found the flaw in its AI-assisted High Touch Support tool on May 31 and counted 20,225 potentially affected Instagram accounts. The abuse hit many high-profile accounts and could expose profile data, messages, posts, and account history; Meta disabled the tool and is reviewing similar recovery flows.
The wider risk is in any support-driven recovery system that trusts a new destination without verifying it against the existing account. Passwords can be fine and the account can still fall if the recovery path becomes the credential.