Twitter: Following a User Actually Follows Another User

ID H1:95243
Type hackerone
Reporter ericr
Modified 2015-12-02T17:40:51


I can display a web intent page to a victim that appears to prompt them to follow one user, but actually ends up following a completely different user when they click "follow". The following is a proof of concept:

This is somewhat related to the last bug I submitted (see #95217), albeit the impact is more dramatic. This can be used by malicious users such as spammers and social engineers to trick a user into following them.