The WeGIA product by LabRedesCefetRJ before version 3.6.9 contains an open redirect vulnerability (CWE-601). Specifically, the redirect parameter from the URL query string is used directly in a header("Location: ...") call without any validation or whitelist enforcement. This flaw enables attackers to craft URLs that redirect users to arbitrary external sites, potentially facilitating phishing or other social engineering attacks. The vulnerability is addressed in version 3.6.9.

An attacker can exploit this vulnerability to redirect users to malicious or untrusted websites by manipulating the redirect parameter. This can be used in phishing campaigns or to bypass security controls that rely on trusted URLs. There is no indication of privilege escalation or direct system compromise from this vulnerability alone.

Upgrade WeGIA to version 3.6.9 or later, where the open redirect vulnerability is fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. Patch status is confirmed fixed in version 3.6.9. No additional mitigation steps are indicated.