The news

Primaries: Hacktron, Hacking OpenAI (13 September 2026) and Discourse GHSA-vhm9-85gw-x335 (28 July 2026).

Hacktron reports that compromising community.openai.com via a HEIF image-upload path, then abusing an OpenAI SSO identity flaw, allowed takeover of ChatGPT and Codex accounts for active forum users. Impact proof: a prompt to an employee's connected Codex opened a harmless PR in an internal monorepo. OpenAI confirmed an OpenAI-side fix the same day as the report. Discourse patched and published the GHSA. OpenAI paid $6,500 on 1 September 2026, scoped to the SSO finding.

Hacktron reported, OpenAI and Discourse patched

The post is by Hacktron researchers Harsh Jaiswal, Mohan Pedhapati and Rahul Maini. They reported the identity flaw through OpenAI's bug bounty program on Bugcrowd. They reported the forum flaw through Discourse's HackerOne program. OpenAI owns the SSO fix and the bounty. Discourse owns the advisory and the patched releases (2026.7.0, 2026.6.1, 2026.5.2 and 2026.1.6). Hacktron says Discourse-hosted customers were already patched, so the rebuild falls to self-hosted Discourse admins.

An identity bug became a source-control event

Coding agents connected to GitHub turn an identity bug into a source-control event. Forum hosts that share SSO with product sessions sit inside the same blast radius as the IdP.

What the posts leave open

  • Award scope: OpenAI's comment in the Hacktron post says testing against the Discourse-hosted forum was excluded from its program. The $6,500 recognizes the OpenAI-side finding only.
  • Other entry points: Hacktron says a compromise of any first-party or third-party service on OpenAI SSO would have led to the same access. Neither post lists those services.
  • Exposure: neither post counts how many forum users could have had accounts taken over before the fix.

What to do now

  • Inventory services that share SSO with ChatGPT, Codex, or similar agent products.
  • Self-hosted Discourse admins: follow GHSA rebuild guidance (git pull and ./launcher rebuild app). Do not assume a web-only upgrade replaced libheif in the image.
  • Security reviewers: read Hacktron's bounty-scope note. Forum testing excluded from OpenAI's program still fed an in-scope identity finding.

The advisory ties the flaw to upstream libheif, tracked as CVE-2026-32882, and credits hacktronai-research as the reporter. See Discourse GHSA-vhm9-85gw-x335 (HEIF RCE).

No PoC

This dispatch stays at trust-boundary and disclosure level. It does not include exploit steps, payloads, or reproduction procedures.