CVE-2026-35396: Wegia Open Redirect Vulnerability

CVE-2026-35396 Overview

CVE-2026-35396 is an Open Redirect vulnerability identified in WeGIA, a web manager for charitable institutions. The vulnerability exists in the /WeGIA/controle/control.php endpoint, where the nextPage parameter fails to be properly validated when combined with specific request parameters (metodo=listarId and nomeClasse=IsaidaControle). This allows attackers to redirect users from the trusted WeGIA domain to arbitrary external websites, enabling phishing attacks, credential theft, malware distribution, and social engineering campaigns.

Critical Impact

Attackers can leverage the trusted WeGIA domain to redirect users to malicious websites, enabling phishing attacks and credential theft against users of charitable institutions.

Affected Products

• WeGIA versions prior to 3.6.9
• WeGIA Web Manager for charitable institutions
• Deployments using /WeGIA/controle/control.php endpoint

Discovery Timeline

• 2026-04-06 - CVE-2026-35396 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-35396

Vulnerability Analysis

This vulnerability is classified under CWE-601 (URL Redirection to Untrusted Site, also known as Open Redirect). The flaw resides in the application's control endpoint at /WeGIA/controle/control.php, which processes the nextPage parameter without adequate validation or sanitization. When an attacker crafts a malicious URL combining specific method parameters (metodo=listarId) with a particular class name (nomeClasse=IsaidaControle), the application blindly redirects users to whatever URL is specified in the nextPage parameter.

The vulnerability requires user interaction to exploit—a victim must click a malicious link. However, because the initial URL appears legitimate (originating from the trusted WeGIA domain), users are more likely to trust and click these links, especially in contexts where charitable organizations communicate with their members or donors.

Root Cause

The root cause of this vulnerability is the absence of input validation and allowlist checking on the nextPage parameter within the control.php endpoint. The application fails to verify whether the destination URL belongs to an approved list of internal pages or trusted external domains. This design oversight allows user-supplied input to directly control the redirect destination without any security constraints.

Attack Vector

The attack is network-based and requires an attacker to craft a malicious URL containing the vulnerable endpoint with a manipulated nextPage parameter pointing to an attacker-controlled domain. The attacker then distributes this URL through phishing emails, social media, or other communication channels. When a victim clicks the link, they are initially directed to the legitimate WeGIA server, which then redirects them to the malicious site. This two-step process masks the true destination and exploits the trust users place in the WeGIA domain.

A typical attack scenario involves constructing a URL to the vulnerable endpoint with parameters such as metodo=listarId, nomeClasse=IsaidaControle, and nextPage set to a malicious external URL. When a user follows this link, they are redirected from the trusted WeGIA application to the attacker's destination, which could host credential harvesting pages designed to mimic the WeGIA login interface.

Detection Methods for CVE-2026-35396

Indicators of Compromise

• HTTP requests to /WeGIA/controle/control.php containing external URLs in the nextPage parameter
• Presence of metodo=listarId and nomeClasse=IsaidaControle parameters combined with suspicious nextPage values
• Unusual redirect responses (HTTP 302/301) from the control.php endpoint pointing to external domains
• Users reporting being redirected to unfamiliar websites after clicking WeGIA-related links

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing external URLs in the nextPage parameter
• Configure intrusion detection systems (IDS) to alert on URL patterns matching the vulnerable endpoint with external redirect targets
• Review web server access logs for requests to control.php with suspicious query string combinations
• Deploy URL filtering to identify requests containing the vulnerable parameter combinations

Monitoring Recommendations

• Enable detailed logging for all requests to /WeGIA/controle/control.php including full query strings
• Set up alerts for HTTP redirect responses originating from the control endpoint that point to external domains
• Monitor for spikes in traffic to the vulnerable endpoint which may indicate active exploitation attempts
• Implement user behavior analytics to detect unusual redirect patterns affecting multiple users

How to Mitigate CVE-2026-35396

Immediate Actions Required

• Upgrade WeGIA to version 3.6.9 or later immediately to address this vulnerability
• Audit existing deployments to identify any instances running vulnerable versions
• Implement web application firewall rules to block external URL values in the nextPage parameter as a temporary measure
• Notify users about potential phishing attempts leveraging this vulnerability

Patch Information

This vulnerability is fixed in WeGIA version 3.6.9. Organizations should upgrade to this version or later to remediate the vulnerability. For detailed patch information, refer to the GitHub Security Advisory GHSA-4qxc-5j5f-4gp5.

Workarounds

• Deploy a web application firewall rule to validate that nextPage parameter values only contain internal or allowlisted URLs
• Restrict access to the /WeGIA/controle/control.php endpoint to authenticated users only
• Implement URL allowlisting at the application proxy level to prevent redirects to external domains
• Consider temporarily disabling the affected functionality if the upgrade cannot be immediately applied

# Example Apache mod_rewrite rule to block external redirects (temporary workaround)
# Add to .htaccess or virtual host configuration
RewriteEngine On
RewriteCond %{QUERY_STRING} nextPage=http[s]?:// [NC]
RewriteRule ^WeGIA/controle/control\.php$ - [F,L]