A heap overflow and SSO misconfiguration exposed OpenAI's internal repos — here's what the attack chain actually looked like

Security researchers at Hacktron published a detailed writeup yesterday showing how they compromised OpenAI's internal GitHub repositories. The attack chained two vulnerabilities: a heap overflow in a widely-used Node.js authentication library and a misconfigured SSO integration that let them escalate from a low-privilege demo account to full repository access.

The heap overflow was in passport-saml version 3.2.4, a library that handles SAML-based single sign-on for thousands of Node.js applications. OpenAI's internal developer portal used it to authenticate employees via Okta. The vulnerability let attackers inject arbitrary XML attributes into the SAML response, which the library then parsed unsafely. In this case, the researchers injected a Role attribute that the downstream authorization logic trusted without validation.

The SSO misconfiguration was the second piece. OpenAI's GitHub organization had a rule that automatically granted write access to any account with Role=internal-developer in its SAML claims. The researchers created a demo account through OpenAI's public developer signup flow, triggered the SAML flow with the injected role claim, and GitHub granted them write access to 47 private repos.

They reported the issue through OpenAI's bug bounty program on September 12. OpenAI patched the SSO rule within 6 hours and upgraded passport-saml across their infrastructure within 18 hours. The researchers received a $42,000 bounty. No evidence of prior exploitation; the attack required chaining two specific conditions that only existed in OpenAI's setup.

What the chain tells us about internal tooling

The researchers didn't find some novel zero-day. They exploited a known heap overflow in a popular library (CVE-2026-23784, patched in passport-saml 3.3.0 two months prior) and a common misconfiguration pattern — trusting SAML claims for authorization without a secondary check.

OpenAI's internal developer portal was running an outdated dependency. That's not unusual; most companies lag 2–4 months behind security patches in non-customer-facing tooling. The problem was the GitHub rule that blindly trusted the Role claim. A defense-in-depth setup would've required a second factor — maybe GitHub team membership synchronized from an internal directory, or a separate API call to verify the user's actual role before granting write access.

The SSO-to-GitHub pipeline is a common weak point. We see it in client setups too: an authentication flow that works perfectly for read access becomes a privilege escalation vector when you add automatic role mapping without validation. The fix is almost always the same: treat SAML claims as hints, not proofs. Verify roles against a source of truth before granting elevated access.

The Node.js ecosystem angle

The passport-saml library has 2.4 million weekly downloads. The heap overflow affected every application using version 3.2.x or earlier that also parsed custom SAML attributes. OpenAI wasn't the only target; the researchers noted that they found 14 other high-profile companies with the same configuration during their research phase.

The library maintainers patched the issue in May, but adoption was slow. Part of the problem is that passport-saml is a transitive dependency for a lot of internal tooling — companies don't always track when an auth library three layers deep in their stack has a critical CVE. OpenAI's 18-hour patch window was actually fast by enterprise standards; the median time-to-patch for non-customer-facing services is closer to 6 weeks.

The Hacktron writeup includes a proof-of-concept that works against any unpatched passport-saml instance with custom attribute parsing enabled. They're not releasing the full exploit, but the technique is straightforward enough that we'll see copycat attempts within a week.

What this means for AI infrastructure specifically

OpenAI's internal repos contain training scripts, eval harnesses, and infrastructure-as-code for their production model serving. The researchers had read access to all of it for about 4 hours before OpenAI's security team detected the anomalous GitHub activity and revoked the session.

They didn't exfiltrate anything (per the bug bounty ethics agreement), but a malicious actor with the same access could've pulled down model weights, training data manifests, or the entire deployment pipeline. OpenAI's post-incident report noted that their GitHub audit logs caught the access pattern quickly, but 4 hours is long enough to clone 47 repos if you script it.

The bigger takeaway: AI companies' internal tooling is just as vulnerable as anyone else's. The high-value targets aren't always the customer-facing APIs; sometimes it's the developer portal that nobody bothered to update because it's "just for employees." OpenAI's fast response was good, but the vulnerability window existed for two months after the patch was available.

For anyone running internal tooling with SSO: audit your role mapping logic. If you're automatically granting access based on SAML claims, add a verification step against your actual directory. If you're using passport-saml, you should be on 3.3.0 or later. And if you're treating your internal services as lower-priority for security patches because they're "not customer-facing," this is the reminder that they're often the easier path to the same data.