Are there any chances that someone was successfully able to get into my account? If yes, then how could they bypass the two-factor authentication?

Facebook is saying that the tokens couldn't be abused to log in to or take over someone's account. They could just be used to view your profile as a different user, or, to view someone else's profile as you. So there seems to be a risk that information might have been leaked, but, total account compromise doesn't seem to have been part of the exploit.

Is that incident normal or I should take security actions?

Action has already been taken for you. Any old token you had is no longer valid, not for you and not for an attacker either. That's why you suddenly were unable to access Facebook without re-logging in again. The same thing is true of anyone who might have wanted to exploit a token which let them spoof as you - they too would have to re-authenticate. None of Facebook's statements suggest that they're able to authenticate as you as the result of this particular exploit or vulnerability. They also don't totally make it clear that Facebook did more than just reset tokens - if that were all that they did, all the attackers would have to do would be to start collecting tokens again. I assume that Facebook patched the vulnerability at the same time so that stolen tokens can't be abused again in the future.

Are there any chances that someone was successfully able to get into my account? If yes, then how could they bypass the two-factor authentication?

If your account had 2fa, it seems unlikely that an attacker could use this exploit to get into it. But many Facebook users don't use 2-factor authentication.

Is that incident normal or I should take security actions?

Action has already been taken for you. Any old token you had is no longer valid, not for you and not for an attacker either. That's why you suddenly were unable to access Facebook without re-logging in again. The same thing is true of anyone who might have wanted to exploit a token which let them spoof as you - they too would have to re-authenticate. None of Facebook's statements suggest that they're able to authenticate as you as the result of this particular exploit or vulnerability. They also don't totally make it clear that Facebook did more than just reset tokens - if that were all that they did, all the attackers would have to do would be to start collecting tokens again. I assume that Facebook patched the vulnerability at the same time so that stolen tokens can't be abused again in the future.

"Are there any chances that someone was successfully able to get into my account? If yes, then how could they bypass the two-factor authentication?"

Facebook is saying that the tokens couldn't be abused to log in to or take over someone's account. They could just be used to view your profile as a different user, or, to view someone else's profile as you. So there seems to be a risk that information might have been leaked, but, total account compromise doesn't seem to have been part of the exploit.

"Is that incident normal or I should take security actions?"

Action has already been taken for you. Any old token you had is no longer valid, not for you and not for an attacker either. That's why you suddenly were unable to access Facebook without re-logging in again. The same thing is true of anyone who might have wanted to exploit a token which let them spoof as you - they too would have to re-authenticate. None of Facebook's statements suggest that they're able to authenticate as you as the result of this particular exploit or vulnerability. They also don't totally make it clear that Facebook did more than just reset tokens - if that were all that they did, all the attackers would have to do would be to start collecting tokens again. I assume that Facebook patched the vulnerability at the same time so that stolen tokens can't be abused again in the future.

Are there any chances that someone was successfully able to get into my account? If yes, then how could they bypass the two-factor authentication?

Facebook is saying that the tokens couldn't be abused to log in to or take over someone's account. They could just be used to view your profile as a different user, or, to view someone else's profile as you. So there seems to be a risk that information might have been leaked, but, total account compromise doesn't seem to have been part of the exploit.

Is that incident normal or I should take security actions?

Action has already been taken for you. Any old token you had is no longer valid, not for you and not for an attacker either. That's why you suddenly were unable to access Facebook without re-logging in again. The same thing is true of anyone who might have wanted to exploit a token which let them spoof as you - they too would have to re-authenticate. None of Facebook's statements suggest that they're able to authenticate as you as the result of this particular exploit or vulnerability. They also don't totally make it clear that Facebook did more than just reset tokens - if that were all that they did, all the attackers would have to do would be to start collecting tokens again. I assume that Facebook patched the vulnerability at the same time so that stolen tokens can't be abused again in the future.