CVE-2026-86256Medium· 5.4▾ TwilightPoC availablewger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET param…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.7 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Exploit / PoC code exists
0.2% → 0.2%
wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect() without validating it with url_has_allowed_host_and_scheme(). An attacker who delivers a crafted link to an authenticated trainer can redirect the trainer's browser to an attacker-controlled domain, enabling phishing and leaking the wger URL structure (including the impersonated user's user_pk) via the Referer header.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
wger < 2.6Patched in:
wger 2.6Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-46437Medium· 4.8wger is a free, open-source workout and fitness manager
CVE-2026-46438Medium· 6.5wger is a free, open-source workout and fitness manager
CVE-2026-46434High· 7.1wger is a free, open-source workout and fitness manager
CVE-2026-43976High· 7.1wger is a free, open-source workout and fitness manager
CVE-2026-86257Medium· 5.4wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas
CVE-2026-45161Medium· 5.4wger is a free, open-source workout and fitness manager