I was able to find a tiny session management vulnerability in the Oculus website and Yay! got acknowledged by Facebook :)