A developer going by BugstoOai dropped a security report in OpenAI's official developer forum last Friday, claiming to have found a logic flaw in how the ChatGPT iOS app validates subscriptions. The core issue? OpenAI's backend checks if an Apple Pay receipt signature is legitimate and verifies that the request's OpenAI auth token is valid—but it doesn't actually verify that the Apple ID on the purchase receipt matches the OpenAI account receiving the ChatGPT Plus upgrade.
The report sums up the current authorization logic as "legitimate receipt + valid token = Plus activated," comparing it to a store clerk who only checks if a receipt is real, never asking to see the buyer's ID.
What's affected
The vulnerability reportedly affects the ChatGPT iOS app (the author notes testing on version v1.2026.xx) and the backend endpoint /backend-api/subscription/upgrade. The report also includes mitigation suggestions: bind receipts to the purchaser's identity, enforce single-use for receipts, add fingerprinting to link Apple IDs with OpenAI accounts, and monitor for the same transaction ID appearing across multiple accounts.
The alleged exploit path
The English post only outlines high-level steps, stating that full reproduction details aren't being disclosed following responsible disclosure principles. It does, however, link to a Chinese article (http://linux.do/t/topic/1981747) as the original source. That Chinese version spells out the alleged exploit path: use a Turkish Apple ID to purchase ChatGPT Plus (monthly fee 499 Turkish lira), intercept the receipt the ChatGPT app sends to OpenAI using a local proxy like mitmproxy, then repeatedly call the subscription API with that same receipt to activate Plus for different accounts. The author claims this is the source of the cheap ChatGPT Plus top-ups being sold on Xianyu, a popular Chinese secondhand marketplace.
Unverified claims
So far, OpenAI hasn't responded to the report on the forum or through other channels. Some users in the discussion thread have questioned whether the content was AI-generated and noted the lack of reproducible evidence. The report doesn't include a full proof-of-concept, and no third-party security researchers have independently verified it. For now, it remains an unconfirmed claim waiting for investigation.