Liberapay member team twitter account broken Link Hijacking via Expired Twitter Account Link
The Liberapay profile of Liberapay team member at liberapay.com/martindelille contains a link to an expired Twitter account, creating a Broken Link Hijacking (BLH) vulnerability. An attacker could register the expired handle and control what appears to be an officially linked social media account.
On the donation page at https://liberapay.com/martindelille/donate, Liberapay displays a "Recipient Identity" section stating: "We have confirmed through an automated verification process that martindelille has control of the following accounts on other platforms:" - including the expired Twitter account. This falsely confirms to donors that the account is legitimate and verified.
Note: martindelille is a Liberapay team member (developer/translator/community manager). This account should not be claimed by security researchers as it would directly impersonate an official team member.
Steps to Reproduce:
- Go to https://liberapay.com/Liberapay/
- Search for the martindelille account in the members section