It is reported that the irreplaceable token sales market OpenSea has already fixed a loophole, once exploited, may expose its secret user identity information.

In an online article on March 9th, Imperva, a cyber security company, explained how this identified the vulnerability, which it claimed could de-polarize OpenSea users by linking IP addresses, computer browser conversations or special case emails to NFT.

Imperva explained that because NFT corresponds to the address of the digital currency wallet, it can reveal the true identity of the user from collecting and linking to the wallet and activity information.

It is understood that the vulnerability exploits a cross-site retrieval vulnerability. Imperva claims that OpenSea is improperly equipped with a library that resizes web elements that load HTML videos from elsewhere, which are typically used to promote products, interact with specific content, or place short videos.

Because OpenSea does not restrict the communication of this library, when the search does not return to all conclusions, the attacker can use the information broadcast for the "saint" to reduce the search scope, because the web page will be smaller.

Imperva details that an attacker can push a connection to his overall target via email or information, which, if clicked, will "disclose meaningful information such as the target IP address, user agent, machine device details, and system version."

The attacker will then take advantage of OpenSea's vulnerability to obtain the target NFT name and associate the corresponding wallet address with authentication information such as email or contact number uploaded based on the initial connection.

Imperva showed that OpenSea "solved the problem quickly" but appropriately hindered library communications, and the report noted that the site "will no longer be exposed to such offensive risks."

For a long time, users of the site have been imitating OpenSea software to exploit victims, such as fraudulent sites like the site, or signature requirements that appear to stem from OpenSea.

OpenSea itself has been criticized for the security of its platform after a major man-in-the-middle attack on the Internet in February 2022 resulted in the theft of more than $1.7 million worth of NFT from users.

For the recent patch, it is not clear at this stage how long it exists, nor whether there are users who have been affected by the attack.

OpenSea didn't immediately respond to Cointelegraph's request for comment.