Wegia CVE-2026-35474

The CVSS v4.0 score of 5.1 (Medium) reflects a low-impact attack with unauthenticated network access and user interaction required (UI:A). The attack vector is network-based (AV:N) with low complexity (AC:L), and confidentiality/integrity impacts are limited (VC:L, VI:L). The exploitation status shows no public exploit code identified at time of analysis, and no CISA KEV status confirmation is provided. Open redirect vulnerabilities are generally considered moderate risk in real-world scenarios because they rely on social engineering (tricking users into clicking malicious links) and the impact is primarily reputational/phishing-oriented rather than direct system compromise. However, when chained with other vulnerabilities or used for credential harvesting, the risk elevates. The combination of low CVSS impact scores, user interaction requirement, and lack of confirmed active exploitation suggests this is a lower-priority vulnerability compared to pre-authentication code execution or privilege escalation flaws, though it should still be patched to prevent phishing attacks against WeGIA users.

An attacker crafts a malicious URL containing a redirect parameter pointing to a phishing site (e.g., a fake login page mimicking WeGIA's interface) and emails this link to users of a WeGIA instance. When a user clicks the link, the vulnerable application processes the redirect parameter without validation and immediately redirects the browser to the attacker's phishing site. The user, expecting to access their legitimate WeGIA application, may not notice the redirect and enters credentials into the fake login page, allowing the attacker to harvest credentials. No public exploit code is independently confirmed, but the simplicity of crafting such URLs (a basic GET request with a redirect parameter) means successful phishing attacks are feasible given only standard web client capabilities.