Callback URL spontaneously changed

[NamePros]

Sometime within the past 24 hours, our OAuth callback URL was changed from the correct URL to https://www.namepros.com/robots.txt. We have no idea how this happened. There are only a few people with access to the account, and none of them recall access the developer settings during that time period. The app was registered through apps.twitter.com (we don’t have access to the new developer portal yet). This has caused numerous login failures.

Does anyone know what might’ve caused this?

It’s worth noting that our callback endpoint is at /register/twitter, which isn’t blocked by robots.txt.

[LeBraat]

Can you please provide us the app ID that you experienced this with?

I strongly recommend that you change the password to your account and make sure to ask all of those individuals who might have had access to your account if they made this change.

If you do believe that someone had access to your account, you might want to consider updating the password to protect your account.

[NamePros]

The app ID is 6585535.

Our in-house security professional has looked at the situation and said that it’s highly unlikely that it’s the result of a breach.

[happycamper]

Hi @NamePros from what I can tell, you do have an approved developer account.

Any update to the callback URL is related to (@namepros) user-triggered events.

Note that there are now 2 places that the callback URL can be updated. In the old apps.twitter.com page, as well as the new https://developer.twitter.com/en/apps management page.

A change to the callback URL must be made in a logged in context, I’d recommend reviewing who has access to the @namepros user, and if needed, change the password on your user account.

[PaulBuonopane]

We didn’t have a new developer account at the time. We applied for one at the same time we visited apps.twitter.com to fix our callback URL.

There is only one person with direct access to that Twitter account, and we confirmed that they hadn’t visited apps.twitter.com around the time it was changed to an invalid URL. Anyone else who requires access typically has to go through the person who maintains it.

There is little to no chance that this was performed by a human. I’m the only person who would ever deal with the apps page, and my interactions with it are audited by another person.

If we’re unable to determine the cause of this modification within the next day or two, our internal policies will require us to treat it as a security breach and launch a formal investigation.

[LeBraat]

We currently do not have a programmatic way for developers to change callback URLs, so this option is very unlikely.

There is not much we can do for you via this public forum. Please submit a the following form to continue this conversation:
https://help.twitter.com/forms/platform