OpenSea, a popular NFT marketplace, has patched a vulnerability in its system that had the potential to expose the identities of its users. The vulnerability was discovered by a Cybersecurity firm Imperva which reported it to the OpenSea team.

On March 9, cybersecurity firm Imperva revealed in a blog post that it had discovered a vulnerability in OpenSea that could potentially compromise the anonymity of its users. According to the post, the vulnerability could reveal a user’s real identity by linking their IP address, browser session, or email to an NFT in certain conditions.

Since an NFT is associated with a cryptocurrency wallet address, the information gathered and linked to the wallet could expose a user’s identity and activity. This vulnerability underscores the importance of strong security measures in the NFT market to safeguard user privacy and prevent potential attacks that could compromise sensitive information.

OpenSea has since addressed the issue and assured users that their data is now secure.

This incident highlights the importance of security measures in the growing NFT market, as the value and popularity of NFTs continue to increase. It also serves as a reminder for companies to take swift action when vulnerabilities are reported by their users.

The OpenSea vulnerability exploited a cross-site search vulnerability resulting from the misconfiguration of a library that resizes webpage elements loading HTML content from elsewhere. Attackers used the library’s unrestricted communications to narrow down when searches returned no results by using the information broadcasted.

Imperva explained that the attacker would send a link through email or SMS to their target, and clicking it would reveal the target’s valuable information, including IP address, user agent, device details, and software versions.