CVE-2026-86256: wger before 2.6 Open Redirect via trainer-login next parameter
wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainerlogin view (wger/core/views/user.py). After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect() without validating it with urlhasallowedhostandscheme(). An attacker who delivers a crafted link to an authenticated trainer can redirect the trainer's browser to an attacker-controlled domain, enabling phishing and leaking the wger URL structure (including the impersonated user's userpk) via the Referer header.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wgerto a version that resolves this vulnerability.Fixed in 2.6
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authenticated trainers who can enter impersonation mode are exposed if they follow an attacker-crafted link. The redirect occurs in the trainer_login view after impersonation mode is entered.
What does an attacker need to exploit it?
An attacker needs to deliver a crafted URL containing a malicious next GET parameter and persuade an authenticated trainer to use it. No interaction from the impersonated user is described.
Are default deployments affected?
The issue affects wger versions up to and including 2.5.0, before version 2.6. The provided data does not identify any configuration prerequisite beyond use of the affected trainer impersonation flow.
What is the impact of a successful redirect?
The trainer's browser can be redirected to an attacker-controlled domain, supporting phishing. The Referer header may also disclose wger URL structure, including the impersonated user's user_pk.