CVE-2026-23729: WeGIA Open Redirect Vulnerability

CVE-2026-23729 Overview

CVE-2026-23729 is an Open Redirect vulnerability identified in the WeGIA web manager application for charitable institutions. The vulnerability exists in the /WeGIA/controle/control.php endpoint, specifically through the nextPage parameter when combined with metodo=listarDescricao and nomeClasse=ProdutoControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites.

Critical Impact

This vulnerability can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. Attackers can craft malicious URLs that appear legitimate, tricking users into visiting harmful external sites.

Affected Products

• WeGIA versions prior to 3.6.2

Discovery Timeline

• 2026-01-16 - CVE CVE-2026-23729 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2026-23729

Vulnerability Analysis

This Open Redirect vulnerability (CWE-601) occurs when the WeGIA application accepts user-controlled input in the nextPage parameter without proper validation. The vulnerable endpoint at /WeGIA/controle/control.php processes redirect requests through specific method and class parameters (metodo=listarDescricao and nomeClasse=ProdutoControle). When these conditions are met, the application blindly redirects users to whatever URL is specified in the nextPage parameter, including external malicious domains.

Open Redirect vulnerabilities are particularly dangerous in trusted applications like WeGIA because users are more likely to click on links from domains they recognize. Attackers can leverage this trust to conduct phishing campaigns by crafting URLs that start with the legitimate WeGIA domain but ultimately redirect victims to attacker-controlled sites designed to harvest credentials or deliver malware.

Root Cause

The root cause of this vulnerability is the lack of input validation and URL sanitization on the nextPage parameter within the control.php endpoint. The application does not verify whether the redirect destination is an allowed internal URL or validate it against a whitelist of permitted domains. This allows any arbitrary URL to be passed through the parameter, enabling attackers to redirect users to external, potentially malicious websites while appearing to originate from the trusted WeGIA application.

Attack Vector

The attack vector is network-based and requires some user interaction. An attacker crafts a malicious URL containing the vulnerable endpoint with an attacker-controlled external URL in the nextPage parameter. The attacker then distributes this link through phishing emails, social media, or other channels. When an authenticated user clicks the link, they are initially directed to the legitimate WeGIA domain but are immediately redirected to the attacker's malicious site. This can be used to steal credentials through fake login pages, distribute malware, or conduct other social engineering attacks while abusing the trust associated with the WeGIA domain.

Detection Methods for CVE-2026-23729

Indicators of Compromise

• HTTP requests to /WeGIA/controle/control.php containing external URLs in the nextPage parameter
• Unusual redirect patterns from WeGIA endpoints to external domains not associated with the organization
• User complaints about being redirected to suspicious websites after clicking WeGIA links
• Web server logs showing requests with metodo=listarDescricao, nomeClasse=ProdutoControle, and nextPage parameters pointing to external domains

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing external URLs in the nextPage parameter
• Monitor web server access logs for requests to control.php with suspicious parameter combinations
• Configure URL filtering to detect attempts to redirect to known malicious domains
• Deploy anomaly detection to identify unusual redirect patterns from the WeGIA application

Monitoring Recommendations

• Enable detailed logging for the WeGIA application, particularly for the control.php endpoint
• Set up alerts for requests containing the vulnerable parameter combination with external URLs
• Monitor user reports of phishing attempts leveraging WeGIA URLs
• Review referrer logs to identify potential abuse of the redirect functionality

How to Mitigate CVE-2026-23729

Immediate Actions Required

• Upgrade WeGIA to version 3.6.2 or later immediately
• Review web server logs for evidence of exploitation attempts
• Implement WAF rules to block requests with external URLs in the nextPage parameter as a temporary measure
• Notify users about potential phishing attempts using WeGIA URLs

Patch Information

This vulnerability is fixed in WeGIA version 3.6.2. Organizations should upgrade to this version or later to remediate the vulnerability. The fix is available through the GitHub Release 3.6.2. For additional details on the patch implementation, see the GitHub Pull Request and the GitHub Security Advisory GHSA-w88p-v7h6-m728.

Workarounds

• Implement URL validation at the web server or WAF level to restrict the nextPage parameter to internal domains only
• Configure the web server to reject requests to the vulnerable endpoint with external URLs
• Use network-level controls to monitor and block suspicious redirect patterns until the patch can be applied
• Educate users about the risks of clicking links, even from trusted domains, and to verify destination URLs before entering credentials