关键漏洞信息 漏洞标题 Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret 漏洞描述 Summary: - Gradio applications running outside of Hugging Face Spaces enable "mocked" OAuth routes when OAuth components are used. This exposes the server's Hugging Face access token in the session cookie, signed with a hardcoded secret. 影响的组件 Affected Component: - functions: , , . 根因分析 1. Real token injected into every visitor's session: - The server stores the real HF access token in a session variable that is injected into the session of any visitor hitting . 2. Hardcoded session signing secret: - The session secret is derived from a hardcoded string when is not set, making the session cookie payload trivially decodable. 攻击场景 Prerequisites: - A Gradio app using OAuth components. - The app is network-accessible. - Host machine has a Hugging Face token configured. - is not set. Steps: 1. Send a GET request to . 2. Follow the redirect to . 3. Base64-decode the session cookie to extract the access token. 修复版本 Patched versions: 漏洞等级 Severity: Low (CVSS Score: 0.0/10) CVE ID CVE-2026-27167 漏洞证明 Proof of Concept: - Python script provided to demonstrate token extraction. 示例输出 Example output: