Twitter disclosed a bug submitted by eissen5c: https://hackerone.com/reports/1015373 – Bounty: $560 [Source]