{
 "id": "AIR-2026-0488",
 "slug": "cve-2026-28415-gradio-open-redirect-in-oauth-flow",
 "title": "CVE-2026-28415: Gradio Open Redirect in OAuth Flow",
 "summary": "Gradio fails to properly validate the target URL parameter during its OAuth flow, leading to an open redirect vulnerability on logout and login callback endpoints. Attackers can leverage this to redirect users to malicious external URLs.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Gradio"
 ],
 "incident_date": "2026-03-01",
 "incident_date_precision": "day",
 "first_reported": "2026-02-27",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28415",
   "publisher": "NVD",
   "title": "CVE-2026-28415: Gradio is an open-source Python package designed for quick prototyping.",
   "published_at": "2026-02-27"
  },
  {
   "url": "https://github.com/advisories/GHSA-pfjf-5gxr-995x",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-28415: Gradio has an Open Redirect in its OAuth Flow",
   "published_at": "2026-03-01"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2026-28415",
  "open-redirect",
  "gradio"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}