CVE-2026-27167 Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret

Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio applications running outside of Hugging Face Spaces automatically enable "mocked" OAuth routes when OAuth components e.g. gr.LoginButton are used. When a user visi...

CVE-2026-27167

creationtimestamp| type| source ---|---|--- 2026-02-27 20:23:08+00:00| published-proof-of-concept| https://github.com/gradio-app/gradio/security/advisories/GHSA-h3h8-3v2v-rg7m 2026-03-01 01:10:21+00:00| seen| https://gist.github.com/alon710/b9cbc8bb91819a5e8479c60ca815f5c4 2026-03-02...