A Twitter security vulnerability discovered in early 2022 has been used to cull the account details of 5.4 million users, and the hacker is offering the set for sale for $30,000, says a new report.