CVE-2021-23435

CVE-2021-23435 is a URL redirection vulnerability affecting thoughtbot's clearance package versions prior to 2.5.0. An attacker can exploit this by manipulating the session[:return_to] value with multiple leading slashes, redirecting users to an external, malicious domain. This medium-severity vulnerability (CVSS 6.1) has a low attack complexity and requires user interaction, potentially leading to information disclosure and integrity compromise. While there is no known active exploitation or public exploit code, the vulnerability has garnered some community discussion and media coverage.