CVE-2013-5726: Tapbots Tweetbot

Medium severity, CVSS 6.8. EPSS: 1.1% chance of exploitation in the next 30 days.

Tweetbot 1.3.3 for Mac, and 2.8.5 for iPad and iPhone, does not require confirmation of (1) follow or (2) favorite actions, which allows remote attackers to automatically force the user to perform undesired actions, as demonstrated via the tweetbot:///follow/ URL.

Affected products

• Tapbots Tweetbot: version 1.3.3 only; version 2.8.5 only

Published 2013-11-12. Last modified 2026-06-16.