X / xAI · Report #36980
Notifications can mark as read by CSRF
Informativestatus
4upvotes
3 Jan 2015disclosed
How it was found
<script src="https://twitter.com/i/notifications"></script>If a website use this code, visitor's Twitter notifications will be marked as read.
You can easily check it locally, I'm not uploading any proof or file.