Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accepts an unvalidated _target_url query parameter, allowing redirection to arbitrary external URLs. This affects the /logout and /login/callback endpoints on Gradio apps with OAuth enabled (i.e. apps running on Hugging Face Spaces with gr.LoginButton). Starting in version 6.6.0, the _target_url parameter is sanitized to only use the path, query, and fragment, stripping any scheme or host.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
References
History
Fri, 27 Feb 2026 22:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accepts an unvalidated _target_url query parameter, allowing redirection to arbitrary external URLs. This affects the /logout and /login/callback endpoints on Gradio apps with OAuth enabled (i.e. apps running on Hugging Face Spaces with gr.LoginButton). Starting in version 6.6.0, the _target_url parameter is sanitized to only use the path, query, and fragment, stripping any scheme or host. | |
| Title | Gradio has Open Redirect in OAuth Flow | |
| Weaknesses | CWE-200 CWE-284 CWE-330 CWE-601 |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-02-27T21:44:51.956Z
Reserved: 2026-02-27T15:33:57.289Z
Link: CVE-2026-28415
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-02-27T22:16:24.497
Modified: 2026-02-27T22:16:24.497
Link: CVE-2026-28415
Redhat
No data.
OpenCVE Enrichment
No data.