Summary of Major Security Incidents (2021–2026)
Published 7/26/2026, 4:44:19 PM
Research indicates that while X (formerly Twitter) has faced significant security challenges between 2021 and 2026, the claim of a specific "critical backend flaw" allowing persistent access is complex and partially contested due to misattributed data. While a massive 2.8 billion record breach occurred in April 2025 involving an insider threat, several specific technical vulnerabilities (CVEs) recently linked to X in some reports actually belong to third-party software.
Summary of Major Security Incidents (2021–2026)
| Incident / Vulnerability | Date | Impact | Mechanism |
|---|---|---|---|
| 2.8B Record Breach | April 2025 | 2.8B profiles exposed | Insider threat; exfiltration of 34GB dataset [Source: https://www.polymerhq.io/blog/x-twitter-breach-highlights-the-danger-of-insider-threats/] |
| OAuth Phishing | Oct 2025 | Persistent Access | Misuse of offline.access scope for permanent tokens [Note: not independently confirmed] |
| Android Zero-Day | 2021-2022 | 5.4M+ accounts | Flaw in account duplication check [Source: https://purplesec.us/breach-report/twitter-zero-day/] |
| CVE-2026-63757 | 2026 | Session Hijacking | Contested: Affects SurrealDB, not X [Source: https://www.cve.org/CVERecord?id=CVE-2026-63757] |
| CVE-2026-49757 | June 2026 | Account Takeover | Contested: Affects Ash Authentication, not X [Source: https://www.cve.org/CVERecord?id=CVE-2026-49757] |
Analysis of Persistent Access Claims
1. The 2025 Insider Threat and Data Breach
In April 2025, a breach involving 2.8 billion user records was reported. This incident was attributed to an insider threat—specifically a disgruntled former employee using the pseudonym "ThinkingOne"—who allegedly exfiltrated a 34GB dataset [Source: https://www.polymerhq.io/blog/x-twitter-breach-highlights-the-danger-of-insider-threats/]. This breach combined historical 2022 data with fresh 2025 metadata, though it primarily resulted in data exposure rather than a "backend flaw" for live account control.
2. OAuth Token Persistence (Late 2025)
Security reports from late 2025 identified phishing campaigns that exploited the offline.access scope on X. By tricking users into authorizing malicious third-party applications, attackers could obtain permanent access tokens. These tokens allowed attackers to maintain access to an account indefinitely, even if the user changed their password or logged out, as the token remained valid until manually revoked in the user's settings [Note: not independently confirmed].
3. Misattributed Vulnerabilities (CVEs)
Recent research data contains significant contradictions regarding specific backend flaws:
- CVE-2026-63757: Often cited as a session hijacking flaw in X, the official CVE record confirms this vulnerability actually exists in SurrealDB (versions before 3.1.0), where unauthenticated attackers can enumerate session UUIDs [Source: https://www.cve.org/CVERecord?id=CVE-2026-63757].
- CVE-2026-49757: Similarly, this June 2026 flaw involving OAuth2/OIDC email-based matching bypass is a vulnerability in Ash Authentication software, not a native flaw in X's backend [Source: https://www.cve.org/CVERecord?id=CVE-2026-49757].
Conclusion
X did suffer a massive security failure in 2025 via an insider threat that exposed billions of records, and it remains susceptible to persistent access via OAuth permission abuse. However, the specific "critical backend flaws" (CVE-2026-63757 and CVE-2026-49757) frequently associated with persistent access in recent reports are incorrectly attributed to X and actually reside in third-party database and authentication libraries.