#SaltLabsResearch

OAuth+XSS Attack Threatens Millions of Web Users With Account Takeover

by

July 29, 2024 at 10:50AM Recent security research by Salt Security’s Salt Labs revealed critical API security flaws in both Hotjar and Business Insider, exposing millions of users to potential account takeover. The flaws involve manipulating the OAuth standard with cross-site scripting, potentially enabling attackers to access sensitive data. The researchers warn that similar vulnerabilities … Read more

Critical ChatGPT Plugin Vulnerabilities Expose Sensitive Data

by

March 13, 2024 at 08:07AM Security researchers at Salt Labs discovered three critical vulnerabilities in the ChatGPT extension, potentially exposing users’ accounts and services to unauthorized access. The first vulnerability occurs during plugin installation, allowing malicious code approval. The second vulnerability lacks proper user authentication, enabling account takeovers. The third vulnerability allows for OAuth redirection … Read more