# CVE-2026-67176: Chargemap open redirect in authentication login endpoint

Source: https://junglewise.ai/threats/cve-2026-67176-chargemap-contains-an-open-redirect-vulnerability-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-67176 · Severity: medium · CVSS 5.4 · Published 2026-11-10

Chargemap is an electric vehicle charging station finder and payment service. An attacker could craft a malicious URL that tricks users into logging in through the service and then redirects them to a fraudulent website, potentially stealing credentials or distributing malware. The vulnerability affects unauthenticated users accessing the login endpoint.

Technologies: [Chargemap](https://junglewise.ai/threats/technologies/chargemap). Vendors: [Chargemap](https://junglewise.ai/threats/vendors/chargemap).

## Quick answers

**Is CVE-2026-67176 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67176 being exploited in the wild.

**How severe is CVE-2026-67176?** Medium severity, with a CVSS score of 5.4, published 10 November 2026.

**Which products and versions are affected?** Chargemap Chargemap.

**Is there a fix for CVE-2026-67176?** Yes: fixed in Version fixed on 2026-07-17. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67176 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-67176?** Check whether you run Chargemap. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Version fixed on 2026-07-17

## Technical details

An open redirect vulnerability exists in Chargemap's authentication login endpoint that allows unauthenticated remote attackers to craft URLs that bypass redirect validation. When a victim visits the malicious link, the login flow redirects them to an attacker-controlled domain after authentication. This is a classic phishing vector for credential harvesting or malware distribution.

## Affected products

- Chargemap Chargemap

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/praksokchea/CVE-2026-67176](https://github.com/praksokchea/CVE-2026-67176)
- [https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-313-02.json](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-313-02.json)

## Related threats

- [Chargemap stored cross-site scripting in user profile](https://junglewise.ai/threats/cve-2026-67175-chargemap-contains-a-stored-cross-site-scripting-vulnerability)