Disclaimer: This report is for technical research and responsible disclosure purposes only. I do not endorse or encourage any unauthorized use, account sharing, or commercial exploitation of this finding. All testing was conducted on accounts I own or with explicit permission.
Summary
I identified a logical vulnerability in the iOS ChatGPT app’s subscription verification flow: OpenAI’s backend validates the cryptographic authenticity of an Apple Pay receipt, but does not verify whether the Apple ID that purchased the receipt matches the OpenAI account receiving the Plus upgrade.
This allows a valid, paid receipt to be reused to activate ChatGPT Plus on any OpenAI account, regardless of the original purchaser’s identity.
Technical Background: Expected Flow
- User initiates purchase in ChatGPT iOS app → App Store charges the Apple ID.
- Apple generates a signed receipt (
transactionReceipt) and stores it locally on the device. - ChatGPT app sends the receipt + current user’s
auth tokento OpenAI backend. - OpenAI verifies:
Receipt signature is valid (via Apple’s verification endpoint)
auth tokenbelongs to an active account
Does NOT verify: Is the Apple ID in the receipt the same as the one linked to this OpenAI account?
Vulnerability Detail
Because the binding check is missing, the authorization logic reduces to:
valid_receipt + valid_auth_token = Plus granted
This is analogous to presenting a genuine store receipt at a service counter—the clerk verifies the receipt is real, but does not check your ID.
Reproduction Outline (High-Level)
(Note: Detailed exploitation steps omitted for responsible disclosure. Available upon request via secure channel.)
-
Obtain a valid iOS receipt
- Purchase ChatGPT Plus via a low-region Apple ID (e.g., Turkey: ~499 TRY/month).
- Intercept the receipt before the app auto-submits it (via local proxy, DNS redirection, or runtime hooking on jailbroken devices).
-
Reuse the receipt via API
-
Send a crafted request to OpenAI’s subscription endpoint:
POST https://chat.openai.com/backend-api/subscription/upgrade Authorization: Bearer <target_account_auth_token> Content-Type: application/json { "receipt": "<base64_encoded_valid_receipt>", "platform": "ios", "product_id": "com.openai.chatgpt.plus", "device_info": { ... } } -
Result: Target account receives Plus status, even though the receipt was purchased by a different Apple ID.
-
-
Impact Amplification
- One paid receipt (~$2.5–3 USD equivalent in Turkey) can activate Plus on unlimited accounts.
- This enables commercial “Plus reselling” at fractions of the official price, causing revenue leakage and unfair system abuse.
Affected Components
- ChatGPT iOS app (all versions tested: v1.2026.xx)
- Backend endpoint:
/backend-api/subscription/upgrade - Verification logic for iOS in-app purchase receipts
Suggested Mitigations
- Bind receipt to purchaser identity: During receipt validation, extract the
original_purchase_date,transaction_id, and critically, theapp_item_id/bundle_id+ verify the Apple ID’s cryptographic signature matches the submitting session. - Implement receipt single-use enforcement: Mark receipts as “consumed” after first successful activation.
- Add device/account fingerprinting: Correlate Apple ID, device identifier (IDFV), and OpenAI account at subscription time.
- Monitor for receipt reuse: Alert on identical
transaction_idororiginal_transaction_idappearing across multiple OpenAI accounts.
original url: linux.do/t/topic/1981747
original Text: (本文仅供技术交流。任何实际操作产生的账号封禁、法律风险，自行承担)
原理：OpenAI 不查 Apple ID 对应关系，拿张收据就能给任意号开会员 正常流程是这么走的： 你 iPhone 上点付款 → App Store 扣钱 → Apple 把收据扔到你手机本地 → ChatGPT App 捡起收据 → App 把收据和你当前登录的账号 token 一起打包发给 OpenAI → OpenAI 验一下收据真假 → 给你账号开 Plus。 挺严谨对吧？ 屁。 漏洞就藏在 OpenAI 验票那一步。 OpenAI 验票的时候，根本不看这张收据是你 Apple ID 买的，还是隔壁老王 Apple ID 买的。它只看两样东西：收据合法不合法，以及你传过来的那个 ChatGPT auth token 是不是活的。 收据合法 + token 有效 = 任意账号变 Plus。 什么 Apple ID 绑定、什么账号对应关系，全不查。这就好比你拿着别人的购物小票去柜台领东西，柜员只看小票真假，不看你身份证。 三端订阅管理都是交给第三方 API 处理的，iOS 系统框架允许 App 把内购凭据往第三方服务器发，这本是正常开发逻辑。但 OpenAI 在这条链路上偷了懒------或者说，压根没想过有人会卡这个环节。 既然漏洞摆在这儿，流程就简单了。 第一步：搞一个土耳其区 Apple ID。 土耳其区 Plus 标价 499 里拉一个月，折人民币大概八十五块。国内定价多少？一百四五。差价自己算。 往这个土区 Apple ID 里充好礼品卡，钱备足。 第二步：拦截收据。 在你 iPhone 上打开 ChatGPT App，别登录你想开 Plus 的目标账号，随便登个临时号或者干脆不登。 内购付款之前，配置网络拦截------核心操作就是阻止 ChatGPT App 把收据发给 OpenAI 服务器。 App Store 那边照常扣钱，Apple 照常把收据扔到你手机本地沙盒目录里。但因为你的拦截，这张收据没自动飞向 OpenAI，而是老老实实待在本地等你来拿。 第三步：导出收据。 导出收据通常需越狱设备或利用系统漏洞。
实际主流玩法有三种：
-
方法 A，端点本地映射。用 DNS 劫持或本地代理，把 ChatGPT App 发往 OpenAI 的请求重定向到你自己的本地服务器。请求里本来就带着 Base64 编码的收据，到了你本地，直接保存下来。工具就那些：mitmproxy、Charles Proxy、自建 HTTPS 代理加一张自签证书。不用越狱，门槛低得令人发指。 方法
-
B，越狱加 Hook。越狱设备上用 Frida 或者 Flex，直接 hook StoreKit 框架，截下 SKPaymentTransaction 的 transactionReceipt，或者读 appStoreReceiptURL 拿收据文件。粗暴直接。 方法
-
C，安卓路径用 Xposed Hook，逻辑类似。 第四步：API 补单。 收据到手，直接往 OpenAI 的订阅接口发请求
注意，这里的 auth token是目标用户给你的登录令牌，权限有限，有效期短。你给他充完 Plus，他立刻改密码，你拿着这张收据去充下一个。 一张土耳其收据八十五块人民币成本，能给无数个账号开 Plus。闲鱼上那些二三十块钱一个月的 GPT Plus 代充，就是这么来的。你以为人家做慈善？人家是拿一张票反复上车。 OpenAI 至今没补这个窟窿。不是补不了，是优先级不够，或者说，他们根本不在乎这点订阅收入的漏洞。毕竟大头在企业 API 那边。 这套流程，技术含量不高，但信息差极高。外面那些收费几千教人"GPT 代充技术"的，教的就是这几步。我今天直接摊开写，省得你们再去交智商税。
