Top 10 winner

ChatGPT Account Takeover - Wildcard Web Cache Deception

Cloudflare cached everything under a share path without decoding a percent-encoded path traversal, while the origin decoded and normalised it. Requesting a traversing share URL therefore caches the victim's auth token at a URL the attacker can then fetch, giving a full account takeover.

Record

Published by

Harel Security Research

Date

4 February 2024

Topic

HTTP

In the archive

• Ranked #9 in the 2024 Top 10 Web Hacking Techniques

Related sources

• ChatGPT Account Takeover: Wildcard Cache Deception

Tags

• cache-deception
• path-traversal
• parser-differential
• url-parsing
• info-leak
• cdn
• cache
• cloudflare
• bug-bounty
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Harel Security Research, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.