Researchers have discovered an account takeover vulnerability in ChatGPT

Information security researchers have identified a critical vulnerability in the ChatGPT chatbot that allowed for full control over a user's account. The attack vector was based on the use of specially crafted shared chats.

The issue was that a malicious chat could execute arbitrary JavaScript code within the victim's active session. This occurred due to vulnerabilities in the MathLive library and the YouTube JSONP mechanism, which were utilized during content rendering.

The exploit was triggered when an authenticated user opened a link to a compromised shared chat. Attackers were able to hijack the session without any further action required from the account owner.

Information about the discovered flaw was reported to the developers for remediation. Users are advised to exercise caution when opening links to shared chats from untrusted sources.