https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 06:29:45 +0000 https://cve.radiocsirt.org/vuln/cve-2026-27167 <p><strong>Affected:</strong> gradio-app gradio</p> <p>Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio applications running outside of Hugging Face Spaces automatically enable &#34;mocked&#34; OAuth routes when OAuth components (e.g. `gr.LoginButton`) are used. When a user visits `/login/huggingface`, the server retrieves its own Hugging Face access token via `huggingface_hub.get_token()` and stores it in the visitor&#39;s session cookie. If the application is network-accessible, any remote attacker can trigger this flow to steal the server owner&#39;s HF token. The session cookie is signed with a hardcoded secret derived from the string `&#34;-v4&#34;`, making the payload trivially decodable. Version 6.6.0 fixes the issue.</p> <p><strong>Affected:</strong> gradio-app gradio</p> <p>Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio applications running outside of Hugging Face Spaces automatically enable &#34;mocked&#34; OAuth routes when OAuth components (e.g. `gr.LoginButton`) are used. When a user visits `/login/huggingface`, the server retrieves its own Hugging Face access token via `huggingface_hub.get_token()` and stores it in the visitor&#39;s session cookie. If the application is network-accessible, any remote attacker can trigger this flow to steal the server owner&#39;s HF token. The session cookie is signed with a hardcoded secret derived from the string `&#34;-v4&#34;`, making the payload trivially decodable. Version 6.6.0 fixes the issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-27167