An attacker can supply an arbitrary destination in the $_GET['redirect'] parameter, which is used directly in a header("Location: ") call without any validation or whitelist. This allows the application to send a user’s browser to an external URL of the attacker’s choice, enabling phishing or social‑engineering campaigns. The vulnerability does not expose remote code execution or direct data exfiltration, but the ability to redirect unsuspecting users carries a moderate risk of credential compromise and undermines user trust.

The WeGIA web manager produced by LabRedesCefetRJ is affected. All versions prior to 3.6.9 contain the unvalidated redirect logic and are therefore vulnerable. Upgrading to version 3.6.9 or later removes the flaw.

The CVSS score of 5.1 classifies the flaw as medium severity, and the EPSS score of less than 1% indicates a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is the construction of a malicious URL that incorporates the redirect parameter; the attacker does not need authentication and does not rely on other system weaknesses. While no public exploitation has been reported, the simplicity of the attack encourages attackers to use it for phishing attempts, making remediation advisable.