A message on HealthCare.gov said users who visited the website would need to create a new password to access their accounts.
"While there's no indication that any personal information has ever been at risk, we have taken steps to address Heartbleed issues and reset consumers' passwords out of an abundance of caution," said the message posted on Saturday.
The Heartbleed security flaw is a "catastrophic bug" believed to affect two out of every three Web servers, according to the Electronic Freedom Foundation.
Read MoreHeartbleed bug: Is changing your password enough?
HealthCare.gov, a health insurance exchange for the 36 states that opted out of creating their own state insurance exchanges, was created under Obama's signature health care law, the 2010 Patient Protection and Affordable Care Act.
The website's launch last fall was dogged by complaints that many users could not access the site to buy insurance or research healthcare plan options. Most of the website's most prominent flaws were eventually remedied.