libheif heap overflow plus OpenAI SSO misconfiguration yields internal monorepo PR 1186742

Hacktron team uploaded crafted HEIF files to community.openai.com. Discourse passed the files to ImageMagick because FastImage lacked HEIF support, invoking vulnerable libheif on Debian-packaged builds. The overflow produced remote code execution, which the researchers used to read session tokens and trigger the SSO flow at auth.openai.com. The token exchange granted access to connected GitHub accounts without further user interaction.

Discourse security advisory and OpenAI’s $6500 bounty payment confirm the timeline: report on 25 July, coordinated patch within 72 hours, and rebuild instruction requiring git pull plus ./launcher rebuild app. No CVE was assigned; the flaw resided in the missing security backport of libheif 1.17.x on older Docker images. The same library path exists in Slack, Meta, and multiple Rails/Node.js deployments.

Operationally the incident shows that SSO federation between a public forum and internal GitHub connectors expands the blast radius of any RCE on the forum host. Self-hosted Discourse instances remain exposed until the base image is rebuilt; hosted customers received the patch automatically.

OpenAI and Discourse both completed remediation before public disclosure. The disclosure record contains no evidence of further lateral movement or data exfiltration beyond the test PR.