The WeGIA web application versions before 3.6.9 contain an open redirect vulnerability (CWE-601) where the redirect parameter from the URL query string is used directly in a Location header without validation. This allows attackers to craft URLs that redirect users to arbitrary external sites, potentially facilitating phishing or other social engineering attacks. The issue is resolved in version 3.6.9. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, user interaction needed, and low impact on confidentiality, integrity, and availability.

Successful exploitation can cause users to be redirected to malicious or untrusted websites, which may be used in phishing or social engineering attacks. There is no direct impact on system confidentiality, integrity, or availability. No known exploits in the wild have been reported.

Upgrade WeGIA to version 3.6.9 or later, where this open redirect vulnerability is fixed. Since the vendor advisory states the issue is resolved in 3.6.9, applying this official fix is the recommended remediation. No additional mitigation steps are indicated.