Chargemap had an open redirect vulnerability in its authentication login endpoint that allowed remote unauthenticated attackers to craft URLs that redirect victims to attacker-controlled domains. This vulnerability was fixed on 2026-07-17. The CVSS score is 5.4, indicating a medium severity issue.