Facebook's app Messenger Kids, made to protect children, has in fact enabled them to be contacted by adult strangers, it has admitted.
The company has acknowledged the issue, blaming it on a "technical error" that has now been fixed.
This error allowed an easy by-pass to the restrictions which were intended to allow children to only interact with other children they know.
The technical error was raised by two US Senators, with an acknowledgement of the fault two weeks after.
Facebook has said it is in discussions with the Federal Trade Commission about the matter. It follows a record-breaking $5 bn fine paid by the company following Cambridge Analytica.
"We are in regular contact with the FTC on many issues and products, including Messenger Kids," Facebook VP Kevin Martin wrote in a letter to two Democrats, as reported by Reuters. He described the flaw as a "technical error".