The Twitter iOS client versions 6.62 and 6.62.1 fail to validate Twitters server certificates for the /1.1/help/settings.json configuration endpoint, permitting man-in-the-middle attackers the ability to view an application-only OAuth client token and potentially enable unreleased Twitter iOS app features.
The product does not validate, or incorrectly validates, a certificate.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| 6.62 (including) | 6.62 (including) | ||
| 6.62.1 (including) | 6.62.1 (including) |