TI-2026-21609 Aliases CVE-2026-27167 GHSA-h3h8-3v2v-rg7m

Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret

MEDIUM 60CWE-522Published 2026-02-27 · Updated 2026-03-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Information disclosure, Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-522 and CWE-798.

Summary

Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio applications running outside of Hugging Face Spaces automatically enable "mocked" OAuth routes when OAuth components (e.g. `gr.LoginButton`) are used. When a user visits `/login/huggingface`, the server retrieves its own Hugging Face access token via `huggingface_hub.get_token()` and stores it in the visitor's session cookie. If the application is network-accessible, any remote attacker can trigger this flow to steal the server owner's HF token. The session cookie is signed with a hardcoded secret derived from the string `"-v4"`, making the payload trivially decodable. Version 6.6.0 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0051 43rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed gradio (gradio-app): 6.6.0gradio (PyPI): 6.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
gradio-app	gradio	4.16.0 to before 6.6.0	6.6.0	Patch available	CNA
—	gradio (PyPI)	4.16.0 to before 6.6.0	6.6.0	Patch available	GHSA-h3h8-3v2v-rg7m

gradio Vendorgradio-app Affected 4.16.0 to before 6.6.0 Fixed in 6.6.0 Patch available CNA
gradio (PyPI) Vendor— Affected 4.16.0 to before 6.6.0 Fixed in 6.6.0 Patch available GHSA-h3h8-3v2v-rg7m

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:gradio_project:gradio::::::python::*	4.16.0 to before 6.6.0	Vulnerable	gradio-app

cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:* Versions 4.16.0 to before 6.6.0 Vulnerable ·gradio-app

Remediation

Fix · CNA gradio (gradio-app) Fixed in 6.6.0
Fix · GHSA-h3h8-3v2v-rg7m gradio (PyPI) Fixed in 6.6.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-27167
2026-10-03 Alias added: GHSA-h3h8-3v2v-rg7m

References

Exploit 1

https://github.com/gradio-app/gradio/security/advisories/GHSA-h3h8-3v2v-rg7m

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-27167

Other 4

TI-2024-26222 Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component… CVSS 3.1CRITICAL 9.8
TI-2024-01607 Local File Inclusion in gradio-app/gradio CVSS 3.1HIGH 7.5
TI-2024-00889 LFI in Gradio CVSS 3.1CRITICAL 9.4
TI-2025-16852 Gradio Blocked Path ACL Bypass Vulnerability CVSS 4.0HIGH 8.7
TI-2026-22690 Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing CVSS 3.1HIGH 8.6
TI-2024-09866 Path Traversal in gradio-app/gradio CVSS 3.0HIGH 8.2

See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences