CVE-2026-35473 describes an Open Redirect vulnerability in the WeGIA application before version 3.6.9. Specifically, the /WeGIA/controle/control.php endpoint improperly validates the nextPage parameter when combined with metodo=listarId and nomeClasse=IentradaControle, enabling attackers to redirect users to untrusted external sites. This lack of validation can be exploited for social engineering attacks such as phishing or malware distribution. The vulnerability has a CVSS 4.0 score of 5.1 (medium severity) and is fixed in WeGIA version 3.6.9.

Successful exploitation allows attackers to redirect users from the legitimate WeGIA domain to arbitrary external websites. This can be leveraged for phishing attacks, credential theft, malware distribution, or other social engineering tactics. There is no indication of direct system compromise or data breach from this vulnerability alone. No known exploits in the wild have been reported.

Upgrade the WeGIA application to version 3.6.9 or later, where this Open Redirect vulnerability is fixed. No other specific mitigations are indicated. Patch status is not explicitly confirmed in the vendor advisory, but the description states the issue is fixed in 3.6.9, so applying this update is the recommended remediation.