Friday , May 9 2025

ChatGPT Account Take Over Vulnerability Let Hackers Gain User’s Online Account

A renowned security analyst and bug hunter, Nagli (@naglinagli), recently uncovered a critical security vulnerability in ChatGPT.

With just a single click, a threat actor could easily exploit the vulnerability and gain complete control of any ChatGPT user’s account.

Microsoft Patches Four Critical Azure and Power Apps Vulns

Microsoft has fixed critical vulnerabilities in its core cloud services, including Azure Automation, Azure Storage, Azure DevOps, and Microsoft Power...
Read More
Microsoft Patches Four Critical Azure and Power Apps Vulns

Qilin Ransomware topped April 2025 with 45+ data leak disclosures

The cyber threat landscape is rapidly changing, with a notable increase in ransomware activity in April 2025, driven by the...
Read More
Qilin Ransomware topped April 2025 with 45+ data leak disclosures

SonicWall Patches 3 Flaws in SMA 100 Devices

SonicWall has released patches for three security flaws in SMA 100 Secure Mobile Access appliances that could allow remote code...
Read More
SonicWall Patches 3 Flaws in SMA 100 Devices

Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed

From April 2024 to April 2025, Flashpoint analysts noted that the financial sector was a major target for threat actors,...
Read More
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed

Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA

Cisco has issued a security advisory for a critical vulnerability in its IOS XE Software for Wireless LAN Controllers (WLCs)....
Read More
Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA

CVE-2025-29824
Play Ransomware Exploited Windows CVE-2025-29824 as Zero-Day

Attackers linked to the Play ransomware operation deployed a zero-day privilege escalation exploit during an attempted attack against an organization...
Read More
CVE-2025-29824  Play Ransomware Exploited Windows CVE-2025-29824 as Zero-Day

Hacker exploited Samsung MagicINFO 9 Server RCE flaw

Hackers are exploiting an unauthenticated remote code execution vulnerability in the Samsung MagicINFO 9 Server to take control of devices...
Read More
Hacker exploited Samsung MagicINFO 9 Server RCE flaw

CISA adds Langflow flaw to its KEV catalog

CISA added the Langflow vulnerability, CVE-2025-3248 (CVSS score 9.8), to its Known Exploited Vulnerabilities catalog. Langflow is a popular tool...
Read More
CISA adds Langflow flaw to its KEV catalog

Google Fixes Android Flaw (CVE-2025-27363) Exploited by Attackers

Google has released its monthly Android security updates, addressing 46 vulnerabilities, including one that has been actively exploited. CVE-2025-27363 (CVSS...
Read More
Google Fixes Android Flaw (CVE-2025-27363) Exploited by Attackers

UAP hosted “UAP Cyber Siege 2025”, A national level cybersecurity competition

The Cyber Security Club, representing the Department of Computer Science and Engineering at the University of Asia Pacific (UAP), has...
Read More
UAP hosted “UAP Cyber Siege 2025”, A national level cybersecurity competition

As a result, opening the doors to sensitive data let attackers execute unauthorized actions; the whole is termed “Account Take Over.”

ChatGPT Account Takeover

Account takeover is a sneaky cyber attack where an attacker or hacker gains access to your account unauthorizedly by either exploiting in the system or stealing your login details.

It is possible for an attacker to conduct a variety of malicious activities after having gained access to a target system or device:-

  • Theft of personal information
  • Fraudulent transactions
  • Spread malware

To access a victim’s ChatGPT account, the attacker exploits a web cache deception vulnerability. This ChatGPT Account Take Over bug made a single-click attack possible, enabling a remote attacker to compromise any user’s account and completely take over the account.

ChatGPT Account Take Over Bug Attack Flow

A web cache deception vulnerability is a sneaky security flaw that lets attackers trick web servers’ caching systems, giving them access to users’ accounts.

A vulnerability like this can arise when a website’s server cache is set up or used incorrectly. Hackers can use this ChatGPT Account Take Over vulnerability to manipulate cached web pages or create fake ones to deceive users.

Here below, we have mentioned the complete attack flow in five key points, and these key points will give you an accessible overview of the complete attack flow:-

  • Attacker crafts a dedicated .css path of the /api/auth/session endpoint.
  • Attacker distributes the link (either directly to a victim or publicly)
  • Victims visit the legitimate link.
  • Response is cached.
  • Attacker harvests JWT Credentials.

If left unchecked, this web cache deception vulnerability could’ve given attackers access to sensitive user information, including:-

  • Names
  • Email addresses
  • Access tokens

While all of these above-mentioned data are retrieved from the OpenAI’s API server, which is accessed via the following URL:-

https[:]//chat[.]openai[.]com/api/auth/session

Then this information could be used to generate a request to “https://chat.openai.com/api/auth/session/victim.css.” No matter if the victim “.css” file was on the server, the server would respond with the same data as “/api/auth/session.”

The server would cache a CSS file and save the victim’s session content, data, and access token in the process due to the “.css” extension.

For the exploit to succeed, the CF-Cache-Status response must confirm a cached “HIT.” This means the data was cached and will be served to the following request within the same region.

An attacker can read a victim’s sensitive data from the cached response if they manipulate the Load Balancer into caching their request on a customized path.

See the flaw in action:-

When Nagli discovered the issue, he acted quickly and responsibly by reporting it to the ChatGPT team. By doing so, he helped to prevent potential harm and ensure the continued safety of ChatGPT users.

Even though the researcher did not receive any financial compensation for his efforts, he asserted that he is proud to have played a role in enhancing the security of the innovative product.

Mitigation

Web cache deception is a highly severe vulnerability that’s relatively easy to exploit. However, there are several ways to mitigate this issue, and here below we have mentioned them:-

  • The cache server should operate based on the application’s cache-control headers.
  • Only cache files if HTTP caching headers allow it.
  • Cache files based on their Content-Type header, not just the file extension.
  • Return HTTP errors like 404 or 302 for non-existent files.

Check Also

Google

Google Fixes Android Flaw (CVE-2025-27363) Exploited by Attackers

Google has released its monthly Android security updates, addressing 46 vulnerabilities, including one that has …

Leave a Reply

Your email address will not be published. Required fields are marked *