Ability to getting Twitter Blue verified badge without purchase it
Medium
X
X (Formerly Twitter)
Submitted None
Team Summary
Official summary from X (Formerly Twitter)
The subscription expiration timestamp was not properly validated when verifying users.
Actions:
Reported by
alp
Vulnerability Details
Technical details and impact analysis
**Summary:**
Hi there. In this report, I submit a bug about getting Twitter Blue verified badge without purchasing it.
## Steps To Reproduce:
1. First, you should buy a Twitter Blue subscription for your account.
2. Change the profile photo of your Twitter account 1 day before your Twitter Blue subscription expires.
3. Check your Twitter profile and ensure your verified badge is gone for review by the Twitter team. (note that, this review will take 1-2 days but it might be good to check from time to time if your account has been reviewed - if it's reviewed and your verified badge is there, you should change again your profile picture before your Twitter Blue subscription is expired)
4. Go to the `App Store` -> `Your App Store Account` > `Subscriptions` section and cancel your Twitter Blue subscription.
5. You should wait one day for your subscription to expire. (please read the note written in step 3)
6. After the subscription expired, try change to your account details if your verified badge still is not there. You'll get a message about your Twitter account is still under review.
Now you have to wait for 2-3 days (no eta about review times but it takes at least 3 days) then the Twitter team will give back your verified badge even your Twitter Blue subscription is expired.
## Impact:
This can harm financial damages to the Twitter team, and malicious actors can't be tracked since they do not pay for the Blue subscription.
## Supporting Material/References:
I recorded this video on PC, and showed that I can't edit any new tweet and I'm no longer a Twitter Blue subscriber :
███
I recorded this video on my iPhone device, and showed that I can't edit any new tweet, I'm no longer a Twitter Blue subscriber and went to my Subscriptions section on App Store to show my Twitter Blue subscription is ended on January 13 2023 :
█████
## Impact
This can harm financial damages to Twitter, Inc., and malicious actors can't be tracked since they do not pay for the Blue subscription.
Report Details
Additional information and metadata
State
Closed
Substate
Duplicate
Submitted
Weakness
Business Logic Errors