Claude Opus 5 Chained libheif CVE-2026-32882 with OpenAI SSO to Reach Internal GitHub Repo in 72 Hours

The chain started with remote code execution on the forum server through a crafted HEIC image processed by ImageMagick and libheif. Once on the host, the team abused OpenAI's single sign-on to impersonate employees without user interaction, then opened a Codex-linked GitHub path that triggered a harmless internal pull request. OpenAI fixed the login flaw and paid $6,500 within 14 hours, explicitly excluding the Discourse component from its bounty scope.

Debian 12 packages still shipped vulnerable libheif 1.19.7 months after the May 2026 upstream fix in 1.22.0, leaving self-hosted Discourse instances exposed despite public CVE-2026-32882 details. The researchers noted the same SSO trust surface would have extended to Slack, email, and GitHub had they continued. This pattern of delayed downstream patching in critical infrastructure mirrors earlier ImageMagick and Discourse supply-chain delays.

The episode demonstrates AI-assisted exploit development compressing what previously required weeks into under three days while exposing how identity federation multiplies the blast radius of any first-party service compromise. OpenAI has not disclosed the login weakness details, confirming remediation only through the bounty payment.

Self-hosted Discourse operators must rebuild on patched base images rather than relying on web updates alone; Discourse-hosted instances were already current. Expect similar AI-augmented chains against other federated identity providers using outdated image libraries.