A heap overflow and SSO misconfiguration to compromise OpenAI internal repos
Hacktron researchers chained a libheif heap overflow in Discourse with an OpenAI SSO flaw to take over employee ChatGPT/Codex accounts and access internal repositories.
On July 25, 2026, Hacktron researchers chained a heap buffer overflow in libheif 1.19.7/1.19.8 (missing Debian security backports, upstream fix never assigned a CVE), reached through Discourse image uploads processed by ImageMagick, to gain remote code execution on community.openai.com. Combined with an SSO identity misconfiguration in the 'Sign in with OpenAI' flow, they took over employees' ChatGPT/Codex accounts with connected GitHub, Slack, and email access, and proved it by opening PR #1186742 in OpenAI's internal openai/openai monorepo. They reported the issues for coordinated patching, received a $6,500 bounty from OpenAI, and Debian shipped fixed libheif packages on August 8, 2026. The team used Claude Opus 4.8 and Claude Opus 5 to locate the missing backport and autonomously develop working x86-64/ARM64 exploits.
- libheif heap overflow (out-of-bounds read/write during HEIC decoding) in Discourse image uploads yielded remote code execution.
- OpenAI SSO misconfiguration turned forum compromise into ChatGPT/Codex account takeover with connected GitHub and Slack access.
- Researchers proved internal repo access by opening a pull request in OpenAI's openai/openai monorepo.
- Claude Opus 4.8 and Opus 5 found the missing backport and developed working exploits autonomously.
- Self-hosted Discourse operators must rebuild Docker images; Discourse Cloud customers were already patched.
- Victims
- OpenAI
- AI models
- Claude Opus 4.8Claude Opus 5
From the original article
8 min read at hacktron.ai
A heap overflow and SSO misconfiguration to compromise OpenAI internal repositories On July 25, 2026, we chained two critical vulnerabilities to compromise multiple OpenAI employees’ ChatGPT accounts. With these accounts, we could then access internal OpenAI repositories, and potentially many other connectors.
By Handy-Man · hacktron.ai
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.