The WeGIA application prior to version 3.6.9 contains an Open Redirect vulnerability (CWE-601) in the /WeGIA/controle/control.php endpoint. The vulnerability arises because the nextPage parameter is not validated or restricted when combined with specific parameters (metodo=listarId and nomeClasse=IsaidaControle). This allows an attacker to craft URLs that redirect users to arbitrary external sites, potentially enabling phishing and other social engineering attacks. The issue is resolved in version 3.6.9 of WeGIA.

Successful exploitation allows attackers to redirect users from the trusted WeGIA domain to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering. There is no indication of direct system compromise or data breach from this vulnerability alone. The impact is primarily on user trust and potential downstream attacks leveraging the redirect.

Upgrade the WeGIA application to version 3.6.9 or later, where this Open Redirect vulnerability has been fixed. No other mitigation or temporary workaround is indicated in the available data.