Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accepts an unvalidated _target_url query parameter, allowing redirection to arbitrary external URLs. This affects the /logout and /login/callback endpoints on Gradio apps with OAuth enabled (i.e. apps running on Hugging Face Spaces with gr.LoginButton). Starting in version 6.6.0, the _target_url parameter is sanitized to only use the path, query, and fragment, stripping any scheme or host.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-28415 Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accepts an u… https://www.cve.org/CVERecord?id=CVE-2026-28415
Post summary
The text references CVE-2026-28415 in Gradio’s OAuth flow but offers no evidence of a PoC, exploit, active use, patch, or detailed technical data.
CVE-2026-28415 Open Redirect Vulnerability in Gradio OAuth Flow Prior to Version 6.6.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28415 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The post announces a newly disclosed open redirect vulnerability in Gradio’s OAuth flow affecting versions before 6.6.0, but it does not provide a proof of concept, exploit code, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | gradio_project | gradio | - | python | - |