An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input.
CVSS 3.1MEDIUM 6.1·Network·No auth·User interaction·EPSS 0.00595·Published 2023-02-09·Fixed in 7.0.4.1CWE-601