CVE-2026-27167: Gradio token leak through mocked OAuth login route

Summary

Gradio versions from 4.16.0 up to, but not including, 6.6.0 automatically enable mocked OAuth routes when OAuth components such as gr.LoginButton are used outside Hugging Face Spaces. A request to /login/huggingface causes the server to store its own Hugging Face access token in the visitor's session cookie. Because that cookie is signed with a hardcoded secret derived from the string "-v4", its payload is trivially decodable, and any remote attacker who can reach the application can steal the server owner's HF token.

Mitigation

Fixed in 6.6.0.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• gradioPyPILLM dependency since 2023-03-14 · 11 tracked dependents

Related items

• HighCVE-2026-119120: Crawl4AI Docker API lets clients choose the HuggingFace model it loadsSame vendor · NVD/CVE Database
• HighGHSA-wf6j-7hvr-gr93: Hydra legacy target blacklist permits unsafe PyYAML loadingSame vendor · Hugging Face Security Advisories
• MediumCVE-2026-100653: vLLM unpinned Hugging Face artifact loads for FunAudioChat and Tarsier2Same vendor · NVD/CVE Database
• HighGHSA-3hmm-rh5q-gwwr: LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loadingSame vendor · Hugging Face Security Advisories
• MediumCVE-2026-80047: Hugging Face Transformers writes remote Python files to disk before trust checkSame vendor · NVD/CVE Database