Yesterday Twitter announced that they had remediated an issue that allowed accounts to stay logged in across multiple devices even after a voluntary password reset.

In an update earlier this week, the social media company explained that the bug meant users who proactively changed their passwords on one device may have still been able to access open sessions on other screens.

It is important to note that users who choose password resets voluntarily may be doing so because they’re concerned their account has been compromised.

In simple terms, the bug meant that a threat actor who was able to access an account in some way would have continued to be able to do so even after such a reset.

It’s been made unclear exactly how long users have been exposed in this way, but Twitter explained that the issue appeared after it made a change “last year” to the systems that power its password reset functionality.

“We have directly informed the people we were able to identify who may have been affected by this, proactively logged them out of open sessions across devices, and prompted them to log in again,” the firm explained.

“We realize this may be inconvenient for some, but it was an important step to keep your account safe and secure from potential unwanted access.”

There is questionable doubt over whether Twitter has notified all those affected. It may be possible that users may want to proactively log out of their account and/or reset passwords across their devices in any case.

Users have been encouraged by the social media giant to familiarize themselves with the security controls available in their settings and to review active open sessions regularly.

“You can also review how to reset a lost or forgotten password on our Help Center,” it added.

An observation shows that Twitter has been in the security news this year for all the wrong reasons.

For instance, it was reported in May that they agreed to pay a $150m fine to settle a federal privacy suit over privacy data violations, while a few months later a former CSO blew the whistle on an alleged litany of security vulnerabilities and mismanagement at the firm.

The post Twitter Password Reset Bug Uncovered User Accounts appeared first on IT Security Guru.


You May Also Like

Berkshire Bank Selects Salt Security for API Security as its Business Operations Scale

Salt Security, the leading API security company, today announced that Berkshire Bank,…

Several EA accounts compromised by phishing mails

Recently, it has been revealed that several EA Sports accounts were compromised…

Ukrainian government targeted in cyberattack

Over a dozen Ukrainian government website have been down since Friday, following…

Taiwan Hit By Multiple DDoS Attacks Following Arrival of Pelosi

Several government websites in Taiwan suffered intermittent outages due to multiple distributed…