wger-project Wger up to 2.5.0 Impersonation wger/core/views/user.py trainer_login Next redirect

Summaryinfo

A vulnerability was found in wger-project Wger up to 2.5.0 and classified as problematic. This vulnerability affects the function trainer_login of the file wger/core/views/user.py of the component Impersonation. Executing a manipulation of the argument Next can lead to redirect. The identification of this vulnerability is CVE-2026-86256. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in wger-project Wger up to 2.5.0 and classified as problematic. This vulnerability affects the function trainer_login of the file wger/core/views/user.py of the component Impersonation. The manipulation of the argument next with an unknown input leads to a redirect vulnerability. The CWE definition for the vulnerability is CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. As an impact it is known to affect integrity. CVE summarizes:

wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect() without validating it with url_has_allowed_host_and_scheme(). An attacker who delivers a crafted link to an authenticated trainer can redirect the trainer's browser to an attacker-controlled domain, enabling phishing and leaking the wger URL structure (including the impersonated user's user_pk) via the Referer header.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-86256 since 09/06/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1204.001.

Upgrading to version 2.6 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-72112). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Project Management Software

Vendor

• wger-project

Name

• Wger

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5.0

Website

• Product: https://github.com/wger-project/wger/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion