Vulnerability in Gradio Open-Source Python Package Allows Token Theft

CVE-2026-27167

What is CVE-2026-27167?

Gradio versions prior to 6.6.0 have a vulnerability where applications using OAuth components automatically enable mocked OAuth routes. This flaw allows attackers to steal access tokens if the application is publicly accessible, as the token is retrieved and stored in the visitor's session cookie. The use of a hardcoded secret makes the session cookie payload easily decodable. Users are advised to upgrade to version 6.6.0 or later for a fix.

References