A "cross-site scripting" (XSS) vulnerability has been discovered on Twitter's Tweetdeck client, leaving millions of users open to account hijacking and more.
Twitter has shut down Tweetdeck while it fixes the problem, despite earlier promising that it had been fixed.
The normal Twitter web interface, and other apps such as Echofon which use Twitter's API, do not seem to be affected. Tweetdeck is aimed at professionals and provides a web- or app-based interface to Twitter with the ability to show multiple views of different searches and users.
The original advice offered by the official Tweetdeck account claimed that the flaw had been fixed, and that users should log out and back in to their accounts to get the update.
But others found that the flaw persisted, despite following the official advice.
"Logged out of Tweetdeck, logged back in, and got this," tweeted journalist Matt Rosoff, posting a picture of a harmless XSS exploit. "So clearly Twitter's 'fix' does not work!"
Tweetdeck then acknowledged that the fault had not been fixed:
"We've temporarily taken TweetDeck services down to assess today's earlier security issue," it tweeted. "We'll update when services are back up."
Theoretically, such flaws can be used to take over accounts, post tweets, unfollow and follow people, and more.
Twitter itself suffered a similar vulnerability in September 2010 that proved embarrassing after it was discovered by an Australian teenager.
Tweetdeck was originally a British company, and was acquired by Twitter for about £25m ($40m) in May 2011.
Twitter had not responded to a request for comment by the time of publication.
guardian.co.uk © Guardian News and Media Limited 2010