Bypassing Digits origin validation which leads to account takeover Analysed #129873 Valid Authentication – 2020-06-24 – 619 Read-only application can publish/delete fleets Analysed #1032468 Valid Access Control Medium 2021-01-04 – 398 Private list members disclosure via GraphQL Analysed #885539 Valid Access Control Low 2020-08-04 – 346 Bypass Password Authentication for updating email and phone number - Security Vulnerability Analysed #770504 Valid Authentication High 2020-02-08 – 288 XSS via Direct Message deeplinks Analysed #341908 Valid Cross-site Scripting – 2019-05-09 – 236 Stored XSS on reports. Analysed #485748 Valid Cross-site Scripting High 2019-04-01 $700 232 XSS and cache poisoning via upload.twitter.com on ton.twitter.com Analysed #84601 Valid Cross-site Scripting – 2019-05-01 – 198 Verify any unused email address Analysed #574962 Valid Access Control – 2019-06-24 $560 197 protected Tweet settings overwritten by other settings Analysed #664038 Valid No weakness recorded Medium 2020-01-01 – 178 url that twitter mobile site can not load Analysed #500686 Valid Denial of Service Low 2019-03-19 $1,120 142 character limitation bypass can lead to DoS on Twitter App and 500 Internal Server Error Analysed #819088 Valid Denial of Service Medium 2020-05-06 – 141 IDOR and statistics leakage in Orders Analysed #544329 Valid Insecure Direct Object Reference Medium 2019-06-14 $289 141 Highly wormable clickjacking in player card Analysed #85624 Valid Misconfiguration and Insecure Design – 2018-05-17 – 134 Changing email address on Twitter for Android unsets "Protect your Tweets" Analysed #472013 Valid Information Disclosure Low 2019-01-18 $2,940 119 [URGENT] Opportunity to publish tweets on any twitters account Analysed #208978 Valid No weakness recorded High 2017-05-22 – 119 Creating malformed URLs via new line character in-between two URLs leads to misrepresented hyperlinks in Tweets/DMs Analysed #712979 Valid Injection and Smuggling Low 2020-01-24 – 96 Twitter lite(Android): Vulnerable to local file steal, Javascript injection, Open redirect Analysed #499348 Valid Access Control Critical 2019-04-29 – 95 Able to see Twitter Circle tweets due to improper access control on the "FavoriteTweet" endpoint Analysed #1694304 Valid Access Control Medium 2024-03-01 – 91 Denial of Service | twitter.com & mobile.twitter.com Analysed #903740 Valid Denial of Service Medium 2020-09-02 $1,120 89 [Studio.twitter.com] See someone else pics Analysed #164649 Valid Authentication – 2017-06-22 – 84 Ability to see hidden likes Analysed #2140960 Valid Access Control Medium 2024-05-10 – 83 Incorrect details on OAuth permissions screen allows DMs to be read without permission Analysed #434763 Valid Information Disclosure Medium 2018-12-14 $2,940 80 Multiple XSS on account settings that can hijack any users in the company. Analysed #503298 Valid Cross-site Scripting Critical 2019-04-01 $700 73 Chained open redirects and use of Ideographic Full Stop defeat Twitter's approach to blocking links Analysed #1032610 Valid Other weaknesses Medium 2022-12-29 $560 70 Ability to add arbitrary images/descriptions/titles to ohter people's issues via IDOR on getrevue.co Analysed #1096560 Valid Insecure Direct Object Reference Critical 2021-05-26 – 67 Viral Direct Message Clickjacking via link truncation leading to capture of both Google credentials & installation of malicious 3rd party Twitter App Analysed #643274 Valid Misconfiguration and Insecure Design High 2019-10-31 – 64 Bypassing x profile verification to receive instant blue checkmark and unlimited profile changes Analysed #2257374 Valid Input Validation and Logic Low 2024-03-26 $250 60 Bypass Password Authentication to Update the Password Analysed #970157 Valid Authentication High 2021-01-11 – 59 reverb.twitter.com redirects to vulnerable reverb.guru Analysed #158148 Valid No weakness recorded – 2016-10-01 – 50 Tracking of users on third-party websites using the Twitter cookie, due to a flaw in authenticating image requests Analysed #329957 Valid Information Disclosure Medium 2019-02-08 $1,120 49 Bypass t.co link shortener in Twitter direct messages Analysed #1148548 Valid Input Validation and Logic Low 2021-05-18 – 44 Bypass Password Authentication to Update the Password Analysed #982293 Valid Authentication Medium 2021-02-12 – 39 niche s3 buckets are readable/writeable/deleteable by authorized AWS users Analysed #129381 Valid Authentication – 2017-04-02 – 39 Urgent : Unauthorised Access to Media content of all Direct messages and protected tweets(Indirect object reference) Analysed #99600 Valid Authentication High 2018-03-21 – 39 XSS on https://app.mopub.com/reports/custom/add/ [new-d1] Analysed #692352 Valid No weakness recorded – 2019-12-07 – 38 Accepting error message on twitter sends you to attacker site Analysed #781673 Valid Open Redirect Medium 2020-03-13 $560 33 Delete direct message history without access the proper conversation_id Analysed #666632 Valid Input Validation and Logic Low 2020-11-20 $560 33 Reset password without knowing current password Analysed #806055 Valid Authentication Low 2020-03-25 – 32 CRLF and XSS stored on ton.twitter.com Analysed #191380 Valid Cross-site Scripting – 2017-07-05 $1,680 32 The Deleted Polls is Still Accessable after 30 Days Analysed #1015373 Valid Information Disclosure High 2023-02-13 $560 28 Twitter Media Studio Source Information Disclosure With Analyst Role Analysed #961757 Valid Information Disclosure Medium 2020-10-26 – 27 [Bypass fixed #664038 and #519059] Application settings change settings that have been set by the user Analysed #712344 Valid Input Validation and Logic Medium 2021-07-13 – 27 File Upload XSS in image uploading of App in mopub Analysed #97672 Valid Cross-site Scripting – 2016-08-25 – 24 CVE-2017-15277 on Profile page Analysed #315906 Valid Information Disclosure Low 2018-03-08 – 23 Twitter for android is exposing user's location to any installed android app Analysed #185862 Valid Information Disclosure Low 2017-01-13 $560 23 lack of input validation that can lead Denial of Service (DOS) Analysed #768677 Valid Denial of Service Medium 2020-03-12 $560 22 Stored XSS in https://app.mopub.com Analysed #642281 Valid Cross-site Scripting Medium 2019-12-17 – 21