# [Urgent] Invalidating OAuth2 Bearer token makes TweetDeck unavailable

Hardcoded TweetDeck OAuth2 consumer secret allowed anyone to invalidate the shared bearer token, breaking all TweetDeck clients with code 89 errors.

- Payout: hidden
- Severity: medium
- Program: X / xAI
- Found by: filedescriptor
- Disclosed: 2019-04-25
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/210779
- Library page: https://bugbountylibrary.com/r/h1%3A210779
- Tags: area:web domain:api domain:web impact:dos kind:bounty platform:hackerone sev:medium tech:oauth technique:reverse-engineering vuln:dos vuln:secrets-leak

**Target:** OAuth2 token invalidation endpoint (api.twitter.com/oauth2/invalidate_token)
**Root cause:** TweetDeck's OAuth2 consumer key/secret were extractable from the desktop app and shared across all clients, so anyone could call the token invalidation endpoint against the single hardcoded bearer token.
**Steps:**
1. Extract consumer key `yT577ApRtZw51q4NPMPPOQ` and secret `3neq3XqN5fO3obqwZoajavGFCUrC42ZfbrLXy5sCv8` from the TweetDeck desktop application.
2. Observe TweetDeck requests using `Authorization: Bearer <token>` with `X-Twitter-Auth-Type: OAuth2Session`.
3. Send `POST https://api.twitter.com/oauth2/invalidate_token` with `Authorization: Basic <base64(key:secret)>` and body `access_token=<bearer token>`.
4. All TweetDeck requests then return `{"errors":[{"code":89,"message":"Invalid or expired token."}]}`.
**How found:** Noticed TweetDeck uses an OAuth2 bearer token in requests, reasoned the token belongs to the TweetDeck client, and extracted the consumer key/secret from the desktop app to test invalidation.
**Exploitation:** Attacker base64-encodes the extracted consumer key:secret as HTTP Basic auth and posts the shared bearer token to the invalidate_token endpoint, revoking it globally and taking TweetDeck offline for all users until a new token is shipped.
**Insight:** Client-side apps that embed OAuth2 consumer secrets and share one bearer token across all installs let anyone holding the secret revoke that token globally; check desktop/mobile binaries for consumer credentials and whether the token is per-client or global.