Hackers Exploit OpenAI's SSO Vulnerability to Access Internal Repositories

• •Hackers exploited OpenAI's SSO vulnerabilities to access internal repositories.
• •A heap buffer overflow in ImageMagick was the primary attack vector.
• •OpenAI patched the vulnerabilities within 14 hours and awarded a $6,500 bounty.

On July 25, 2026, researchers from Hacktron exploited vulnerabilities in OpenAI's single sign-on (SSO) system to gain access to internal repositories. The attack was facilitated by a flaw in the Discourse platform used for OpenAI's community forum, allowing account takeover of ChatGPT and Codex accounts. The researchers reported the vulnerabilities through OpenAI's Bug Bounty Program and received a $6,500 reward. The exploitation involved a heap buffer overflow vulnerability in the ImageMagick library, which was not officially tracked as a CVE. OpenAI responded quickly, patching the vulnerabilities within 14 hours. The researchers emphasized that the issue stemmed from OpenAI's SSO configuration rather than Discourse itself. The incident highlights potential risks associated with third-party service integrations.