The vulnerability exists because WeGIA versions before 3.6.9 take the redirect parameter from user input ($_GET) without validation or whitelist checks and use it directly in a header("Location: ...") call. This allows an attacker to craft URLs that redirect users to arbitrary, potentially malicious sites. The issue is classified as CWE-601 (URL Redirection to Untrusted Site). The vendor fixed this issue in version 3.6.9.

Successful exploitation could lead to users being redirected to untrusted external sites, which may facilitate phishing or other social engineering attacks. There is no indication of direct code execution or data compromise from this vulnerability alone. The CVSS score of 5.1 reflects a medium impact primarily due to user interaction and the potential for indirect harm.

Upgrade WeGIA to version 3.6.9 or later, where the vulnerability is fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. No other mitigations are specified or required.