Hacktron · Disclosed Exploit Chain

Hacking OpenAI

A responsible-disclosure write-up chaining a heap buffer overflow in libheif, reached through Discourse's ImageMagick-based HEIF decoder, with an SSO misconfiguration in OpenAI's identity infrastructure. The researchers report that a malicious HEIF image uploaded to the community forum gave remote code execution, which they then escalated through SSO from forum accounts to ChatGPT and Codex access. Reported to OpenAI through Bugcrowd and to Discourse through HackerOne on 25 July 2026, with OpenAI confirming a fix the same day and paying a $6,500 bounty, and Discourse publishing advisory GHSA-vhm9-85gw-x335 on 28 August. OpenAI noted that testing against the Discourse-hosted forum was outside bounty scope.