Gradio applications built with versions starting at 4.16.0 through 6.5.0 expose a flaw when OAuth components such as gr.LoginButton are employed outside of Hugging Face Spaces. By visiting the special /login/huggingface route, the server automatically retrieves its own Hugging Face access token and stores it inside the visitor’s session cookie. The session cookie is signed with a hardcoded secret derived from the string "-v4", which means the cookie can be decoded trivially. An attacker who can reach the application over the network can trigger this flow and capture the server’s credentials, compromising the entire Hugging Face integration. This is a classic case of improper secret management and storage of sensitive data in client-side cookies.

The vulnerability affects the Gradio package distributed by gradio-app. Any deployment of Gradio version 4.16.0 up to and including 6.5.0 that is exposed to external network traffic and uses OAuth UI components is impacted. Gradio 6.6.0 and later versions contain the fix and are not affected.

Detailed severity is not provided, but the potential to exfiltrate server credentials makes the impact high. The EPSS score indicates that current public exploitation probability is very low (<1%). The vulnerability is not listed in CISA’s KEV catalog, suggesting it has not been actively exploited in the wild yet. The likely attack vector is a remote, unauthenticated user accessing the exposed /login/huggingface endpoint, which then results in credential theft. Exploitation requires only network connectivity to the vulnerable service and the presence of OAuth components in the code.