Security expert Cesar Cerrudo discovered the problem in a blog post published Tuesday. The issue is the result of a flaw in Twitter’s API (application programming interface) The issue was reported to Twitter on Jan. 16 and was addressed in less than 24 hours, he said. Twitter’s fix does not seem to apply retroactively, according to the researcher. Users should check if any of the apps they authorized in the past also gained access to their direct messages without their knowledge, he says.”]

