2024-03 · 2024-Q1
ChatGPT Plugin/Extension Vulnerabilities
Layer tags: not yet tagged.
Target
ChatGPT plugins, PluginLab.ai, Kesem AI
Impact
OAuth credential theft, zero-click account takeover, malicious plugin installation; GitHub account access possible
Root Cause
Missing authentication in plugin install flow; missing user account verification in PluginLab