Discourse Image Flaw Could Expose OpenAI Staff Accounts and SSO‑Linked Services

Researchers at Hacktron say they used a vulnerability in Discourse’s image-processing pipeline to take over OpenAI staff accounts authenticated through “Sign in with OpenAI”. The forum processed HEIC and HEIF uploads with ImageMagick and libheif; a heap buffer overflow in libheif could allow memory outside the intended area to be read or written. The flaw had reportedly been fixed upstream the previous year, but the fix had no CVE and was not backported to Debian in time.

Hacktron said it adapted an exploit to Discourse’s x86-64 server environment using jemalloc, achieving code execution and ultimately root-level access on a test cloud system before testing the OpenAI instance.

The researchers said the shared SSO arrangement meant compromise of the public forum could expose linked ChatGPT and Codex accounts, and potentially connected services such as GitHub, Slack and email. To demonstrate access without causing damage, they used one hijacked employee’s Codex account to open a harmless pull request in an internal repository, without reading source code or merging changes. They reported the issue to OpenAI and Discourse.

OpenAI confirmed a fix roughly 14 hours after the initial report and paid a $6,500 bounty, clarifying that the award covered the OpenAI-side finding and not testing against the Discourse-hosted community forum. Discourse had a patch ready by the following Monday and added sandboxing around image processing.

Hacktron said AI reduced exploitation time: Claude Opus 5 produced a working exploit against a local Mac in three hours, after Opus 4.8 had struggled with ASLR enabled. The researchers advised checking the actual libheif version used by systems accepting HEIC, HEIF or AVIF files, and reviewing whether low-trust services share SSO with sensitive infrastructure.