Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accepts an unvalidated _target_url query parameter, allowing redirection to arbitrary external URLs. This affects the /logout and /login/callback endpoints on Gradio apps with OAuth enabled (i.e. apps running on Hugging Face Spaces with gr.LoginButton). Starting in version 6.6.0, the _target_url parameter is sanitized to only use the path, query, and fragment, stripping any scheme or host.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-200",
"CWE-284",
"CWE-330",
"CWE-601"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28415.json"
}{
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "6.6.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"cpe": "cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "6.6.0"
}
],
"source": "CPE_RANGE"
}
]
}