An Open Redirect flaw exists in the /WeGIA/controle/control.php endpoint of the WeGIA application when the nextPage parameter is used with metodo=listarTodos and nomeClasse=InternoControle. The application does not validate or constrain nextPage, enabling an attacker to redirect a user to any arbitrary external site. This can be leveraged for phishing, credential theft, malware delivery, or social‑engineering attacks that exploit the trusted WeGIA domain.

The vulnerability affects instances of the WeGIA web manager provided by LabRedesCefetRJ, up to version 3.7.2. Versions 3.7.3 and later contain the fix.

The CVSS score of 5.4 indicates a moderate risk. No EPSS data is available, and the vulnerability is not in the CISA KEV catalog. An attacker can abuse the flaw by simply visiting a crafted URL; no special authentication or privileged access is required, making it highly likely to be exploited in the field.