Twitter disclosed a bug submitted by jub0bs: https://hackerone.com/reports/1421345 – Bounty: $560 [Source]