writeups.xyz / Security Flaws within ChatGPT Ecosystem Allowed Access to Accounts On Third-Party Websites and Sensitive Data

Submitter : c2a

Date: 13 March 2024

Bounty : undisclosed

Vulnerabilities :

• AI
• LLM
• Account Takeover
• OAuth

Programs :

• OpenAI (ChatGPT)
• PluginLab.AI
• KesemAI

Authors :

• Aviad Carmel (@AviadCarmel)

Link :
https://salt.security/blog/security-flaws-within-chatgpt-extensions-allowed-access-to-accounts-on-third-party-websites-and-sensitive-data