CVE-2026-28415

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accepts an unvalidated _target_url query parameter, allowing redirection to arbitrary external URLs. This affects the /logout and /login/callback endpoints on Gradio apps with OAuth enabled (i.e. apps running on Hugging Face Spaces with gr.LoginButton). Starting in version 6.6.0, the _target_url parameter is sanitized to only use the path, query, and fragment, stripping any scheme or host.

Adversary identifies a target organization's Gradio app on HuggingFace Spaces with OAuth enabled. They craft a phishing URL pointing to the legitimate /logout endpoint with _target_url=https://attacker-controlled-site.com. Email or Slack message to ML engineer reads: 'Please re-authenticate to access the fine-tuning dashboard' with the crafted link. Victim clicks, hits the legitimate Gradio domain, gets transparently redirected to the attacker's credential harvesting page styled to mimic HuggingFace login. Attacker captures HuggingFace OAuth token, gains access to private model repos, datasets, and inference APIs. Entire chain uses a legitimate, trusted domain — bypasses URL reputation filters.