CVE-2021-23495: Karma Project Karma

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parameter.

Affected products

• Karma Project Karma: before 6.3.16 (fixed in 6.3.16)

Published 2022-02-25. Last modified 2026-06-17.