{"id":"CVE-2026-28415","published":"2026-02-27T21:44:51Z","modified":"2026-03-02T21:55:38Z","title":"Gradio has Open Redirect in OAuth Flow","vendor":"gradio-app","product":"gradio","tier":"tail","description":{"text":"Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accepts an unvalidated _target_url query parameter, allowing redirection to arbitrary external URLs. This affects the /logout and /login/callback endpoints on Gradio apps with OAuth enabled (i.e. apps running on Hugging Face Spaces with gr.LoginButton). Starting in version 6.6.0, the _target_url parameter is sanitized to only use the path, query, and fragment, stripping any scheme or host.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00288,"percentile":0.21322,"provenance":"source"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"},{"id":"CWE-284","name":"Improper Access Control"},{"id":"CWE-330","name":"Use of Insufficiently Random Values"},{"id":"CWE-601","name":"URL Redirection to Untrusted Site"}],"references":[{"url":"https://github.com/gradio-app/gradio/security/advisories/GHSA-pfjf-5gxr-995x","tags":["x_refsource_CONFIRM"]}],"priority":{"score":7.3,"factors":[{"name":"EPSS percentile","points":4.26},{"name":"CVSS severity","points":3.01}]},"vendorSlug":"gradio-app","affectedVersions":[{"vendor":"gradio-app","product":"gradio","versions":["< 6.6.0"]}],"affected":[{"ecosystem":"PyPI","package":"gradio","vulnerableRanges":["<6.6.0"],"patched":["6.6.0"],"from":["GHSA-pfjf-5gxr-995x","PYSEC-2026-65"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-9083","exploited":false,"provenance":"source"}}