TI-2026-59042 Aliases CVE-2026-86256 GHSA-rc6j-63fm-mhq4

wger before 2.6 Open Redirect via trainer-login next parameter

MEDIUM 56CWE-601Published 2026-09-06 · Updated 2026-09-09

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Spoofing
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-601.

Summary

wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect() without validating it with url_has_allowed_host_and_scheme(). An attacker who delivers a crafted link to an authenticated trainer can redirect the trainer's browser to an attacker-controlled domain, enabling phishing and leaking the wger URL structure (including the impersonated user's user_pk) via the Referer header.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00234 14th percentileScored 2026-11-07

Fix Fixed wger (wger-project): 2.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
wger-project	wger	before 2.6	2.6	Patch available	CNA

wger Vendorwger-project Affected before 2.6 Fixed in 2.6 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:wger:wger::::::::	—	—	wger-project

cpe:2.3:a:wger:wger:*:*:*:*:*:*:*:* Versions — — ·wger-project

Remediation

Fix · CNA wger (wger-project) Fixed in 2.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-06
wger-project wger 2.6
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2026-59043 wger before 2.6 CSV Formula Injection via member exportPriority MEDIUM 55
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-86256
2026-10-03 Alias added: GHSA-rc6j-63fm-mhq4

References

Advisory 1

GitHub Security Advisory (GHSA-vqv8-j3mj-wjxj)

TI-2026-32005 wger: cross-tenant password reset and plaintext disclosure via gym=None bypass CVSS 3.1CRITICAL 9.9
TI-2022-02450 Improper Restriction of Excessive Authentication Attempts in wger-project/wger CVSS 3.1CRITICAL 9.8
TI-2023-20093 Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager… CVSS 3.1HIGH 8.8
TI-2026-32021 wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API CVSS 3.1HIGH 7.5
TI-2026-32022 wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers CVSS 3.1HIGH 8.1
TI-2026-29226 wger has Broken Access Control in the Global Gym Configuration Update Endpoint CVSS 3.1HIGH 7.6

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences