User information could be up for grabs, as well as the potential to allow attackers to control services linked to Facebook via its Connect feature.