libheif overflow + SSO flaw let researchers reach OpenAI's internal repos

Researchers at Hacktron chained two bugs to hijack OpenAI employees’ ChatGPT and Codex accounts, and the whole path from discovery to internal-repo access took under 72 hours. The entry point was community.openai.com, OpenAI’s Discourse-based help forum. Because Discourse’s FastImage checker doesn’t handle HEIF, uploaded HEIC/HEIF files were routed to ImageMagick and, through it, straight into libheif — where a heap buffer overflow yielded out-of-bounds read/write during decoding and, ultimately, remote code execution. The flawed code had been quietly changed upstream a year earlier without a CVE or security label, so the backport never reached Debian 12/13, and Discourse’s Docker image shipped the vulnerable libheif 1.19.7.

RCE on the forum mattered because OpenAI wires the forum to its own identity system via ‘Sign in with OpenAI.’ An SSO misconfiguration turned forum compromise into zero-interaction takeover of active members’ ChatGPT and Codex accounts. Since users connect services like GitHub, Slack, and email to those accounts, the blast radius was large. To prove impact without touching sensitive data, the team used a victim employee’s Codex — connected to OpenAI’s GitHub org — to open a harmless pull request in the internal openai/openai monorepo, then stopped.

The researchers leaned heavily on Claude (Opus 4.8, then Opus 5.5) to find the missing backport and build a reliable ASLR-enabled exploit, including an autonomous loop that only cooperated once the target was disguised as a CTF. OpenAI patched within about 14 hours and paid a $6,500 bounty — explicitly for the SSO finding, since testing the third-party Discourse host was out of scope. Discourse fixed the dependency within days and added ImageMagick sandboxing, publishing advisory GHSA-vhm9-85gw-x335. The work is part of a broader ‘HEIF Heist’ effort tracing the same libheif exposure across Slack, Meta, GitHub Enterprise, Rails, and JS frameworks like Next.js, Astro, and Gatsby — a reminder of how one obscure image library becomes a systemic supply-chain risk.