The researcher confirmed Tuesday that he successfully reproduced the behavior several times by revoking access to the app and going through the authorization process again without being warned that the app would be able to read his private messages. The issue was reported to Twitter on Jan. 16 and was addressed in less than 24 hours, he said.
"They said the issue occurred due to complex code and incorrect assumptions and validations," Cerrudo said in the blog post.
However, Twitter's fix does not seem to apply retroactively. After Twitter fixed the issue, the app Cerrudo was testing that already had access to his account continued to display direct messages despite never receiving authorization from him to do so, he said.
Twitter users should check if any of the apps they authorized in the past also gained access to their direct messages without their knowledge, Cerrudo said. This can be done by reviewing their permissions on the Twitter Settings > Apps page.
Cerrudo decided to make this issue public because it can have serious implications and because Twitter did not issue a public advisory or announcement about it. The company should maintain a dedicated page where it can inform users about security issues, he said.
Twitter did not immediately respond to a request for comment.