CVE-2026-28415: Gradio Open Redirect in OAuth Flow

# CVE-2026-28415: Gradio Open Redirect in OAuth Flow

https://gcdradar.vercel.app/incidents/cve-2026-28415-gradio-open-redirect-in-oauth-flow · AIR-2026-0488 · closed 2026-02-27

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-02-27 (happened 2026-03-01)
- AI role: Attack on AI
- Products: Gradio
- CVE ids: CVE-2026-28415
- CVSS: 4.3

## Summary

Gradio fails to properly validate the target URL parameter during its OAuth flow, leading to an open redirect vulnerability on logout and login callback endpoints. Attackers can leverage this to redirect users to malicious external URLs.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-03-01: CVE-2026-28415: Gradio has an Open Redirect in its OAuth Flow (https://github.com/advisories/GHSA-pfjf-5gxr-995x)
- 2026-02-27: CVE-2026-28415: Gradio is an open-source Python package designed for quick prototyping. (https://nvd.nist.gov/vuln/detail/CVE-2026-28415)

## Sources

- 2026-02-27 NVD: CVE-2026-28415: Gradio is an open-source Python package designed for quick prototyping. https://nvd.nist.gov/vuln/detail/CVE-2026-28415
- 2026-03-01 GitHub Advisory Database: CVE-2026-28415: Gradio has an Open Redirect in its OAuth Flow https://github.com/advisories/GHSA-pfjf-5gxr-995x

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.