gradio-app gradio up to 6.5.x Query Parameter /logout _redirect_to_target _target_url information disclosure

Summaryinfo

A vulnerability was found in gradio-app gradio up to 6.5.x. It has been rated as problematic. Impacted is the function _redirect_to_target of the file /logout of the component Query Parameter Handler. Performing a manipulation of the argument _target_url results in information disclosure. This vulnerability was named CVE-2026-28415. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in gradio-app gradio up to 6.5.x. It has been classified as problematic. This affects the function _redirect_to_target of the file /logout of the component Query Parameter Handler. The manipulation of the argument _target_url with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accepts an unvalidated _target_url query parameter, allowing redirection to arbitrary external URLs. This affects the /logout and /login/callback endpoints on Gradio apps with OAuth enabled (i.e. apps running on Hugging Face Spaces with gr.LoginButton). Starting in version 6.6.0, the _target_url parameter is sanitized to only use the path, query, and fragment, stripping any scheme or host.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-28415 since 02/27/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 6.6.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-9083). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• gradio-app

Name

• gradio

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5

Website

• Product: https://github.com/gradio-app/gradio/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion