CVE-2026-35398: WeGIA Open Redirect Vulnerability

CVE-2026-35398 Overview

CVE-2026-35398 is an Open Redirect vulnerability discovered in the WeGIA application, a web-based management platform designed for charitable institutions. The vulnerability exists in the /WeGIA/controle/control.php endpoint, where the nextPage parameter fails to properly validate user-supplied input when combined with specific method parameters. This security flaw allows attackers to craft malicious URLs that redirect users from the trusted WeGIA domain to arbitrary external websites, enabling sophisticated phishing campaigns and credential theft operations.

Critical Impact

Attackers can leverage the trusted WeGIA domain to redirect users to malicious websites, enabling phishing attacks, credential theft, malware distribution, and social engineering campaigns targeting charitable institution employees and donors.

Affected Products

• WeGIA versions prior to 3.6.9
• WeGIA web management platform for charitable institutions
• Installations utilizing the /WeGIA/controle/control.php endpoint

Discovery Timeline

• April 6, 2026 - CVE-2026-35398 published to NVD
• April 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35398

Vulnerability Analysis

This Open Redirect vulnerability (CWE-601) stems from insufficient input validation in the WeGIA application's control endpoint. The vulnerable parameter nextPage accepts arbitrary URLs without proper sanitization when used in conjunction with specific query parameters: metodo=listarTodos, listarId_Nome, and nomeClasse=OrigemControle. When a user clicks a crafted link containing a malicious redirect target, they are seamlessly redirected away from the legitimate WeGIA application to an attacker-controlled destination.

The network-based attack vector requires user interaction, as victims must click the malicious link for the redirect to occur. However, the use of a trusted domain in the URL significantly increases the likelihood of successful attacks, as security-conscious users may verify the domain without examining URL parameters.

Root Cause

The root cause of CVE-2026-35398 lies in the application's failure to implement proper URL validation and whitelisting for redirect destinations. The nextPage parameter in /WeGIA/controle/control.php accepts any URL value without checking whether the destination is an internal application path or an external domain. This permissive input handling violates the security principle of validating all user-controlled input, particularly for security-sensitive operations like URL redirects.

Attack Vector

The attack exploits the trusted relationship between users and the WeGIA domain. An attacker constructs a URL pointing to the legitimate WeGIA server with carefully crafted parameters:

1. The base URL targets the vulnerable endpoint at /WeGIA/controle/control.php
2. The attacker includes the required parameters: metodo=listarTodos, listarId_Nome, and nomeClasse=OrigemControle
3. The nextPage parameter is set to an attacker-controlled malicious URL
4. When distributed via email or social media, the link appears legitimate due to the trusted WeGIA domain
5. Upon clicking, the victim is redirected to the malicious destination where credential harvesting or malware distribution occurs

The vulnerability can be exploited by crafting URLs that follow this pattern with the nextPage parameter pointing to an external malicious domain. For complete technical details, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-35398

Indicators of Compromise

• HTTP requests to /WeGIA/controle/control.php containing nextPage parameters with external domains
• Log entries showing successful redirects to non-whitelisted external URLs
• User reports of unexpected redirects when accessing WeGIA application links
• Phishing emails containing WeGIA URLs with suspicious nextPage parameter values

Detection Strategies

• Implement web application firewall (WAF) rules to inspect nextPage parameters for external URL patterns
• Monitor access logs for requests containing the vulnerable parameter combination (metodo=listarTodos, listarId_Nome, nomeClasse=OrigemControle, nextPage)
• Deploy URL filtering solutions to detect redirect chains originating from WeGIA endpoints
• Configure SIEM alerts for unusual redirect patterns involving the control.php endpoint

Monitoring Recommendations

• Enable verbose logging for the /WeGIA/controle/control.php endpoint to capture all parameter values
• Implement real-time alerting for external domain references in redirect parameters
• Monitor for increased phishing reports that reference the WeGIA domain
• Track HTTP 302/301 response codes from the vulnerable endpoint paired with external Location headers

How to Mitigate CVE-2026-35398

Immediate Actions Required

• Upgrade WeGIA to version 3.6.9 or later immediately
• If immediate upgrade is not possible, implement WAF rules to block external URLs in the nextPage parameter
• Notify users and administrators about the potential for phishing attacks leveraging WeGIA URLs
• Review access logs for evidence of prior exploitation attempts

Patch Information

The vulnerability has been addressed in WeGIA version 3.6.9. Organizations running affected versions should upgrade to the patched release as soon as possible. Detailed patch information and security advisory details are available in the WeGIA GitHub Security Advisory.

Workarounds

• Implement a web application firewall rule to validate the nextPage parameter against a whitelist of allowed internal paths
• Use URL rewriting to strip or sanitize the nextPage parameter at the reverse proxy level
• Restrict access to the vulnerable endpoint until the patch can be applied
• Educate users to verify full URLs including parameters before clicking links, even from trusted domains

# Example Apache mod_rewrite rule to block external redirects
# Add to .htaccess or virtual host configuration
RewriteEngine On
RewriteCond %{QUERY_STRING} nextPage=https?:// [NC]
RewriteRule ^WeGIA/controle/control\.php$ - [F,L]