CVE-2026-86256
Received Received - Intake

Open Redirect Vulnerability in wger Fitness Workout Manager

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: VulnCheck

Description
wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect() without validating it with url_has_allowed_host_and_scheme(). An attacker who delivers a crafted link to an authenticated trainer can redirect the trainer's browser to an attacker-controlled domain, enabling phishing and leaking the wger URL structure (including the impersonated user's user_pk) via the Referer header.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-06
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2026-86256
EUVD
EUVD-2026-72112

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wger wger to 2.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an open redirect flaw in the wger fitness application versions 2.5.0 and earlier. It exists in the trainer_login view where the 'next' GET parameter is not validated before redirecting users. An attacker can craft a malicious link that, when clicked by a trainer in impersonation mode, redirects the trainer to an attacker-controlled domain. This exposes sensitive information like the wger URL structure and impersonated user details via the Referer header.

Detection Guidance

To detect this vulnerability, check if your wger instance is running a version 2.5.0 or earlier. Inspect the trainer_login view in wger/core/views/user.py for the presence of the 'next' parameter in HttpResponseRedirect() without validation using url_has_allowed_host_and_scheme().

Commands to check version: grep -r 'version' /path/to/wger/ | grep -i '2.5.0' or check the web interface footer. Inspect the code: grep -A 5 -B 5 'HttpResponseRedirect' wger/core/views/user.py

Impact Analysis

If you are a trainer using wger versions 2.5.0 or earlier, clicking a malicious link could redirect your browser to a phishing site controlled by an attacker. This may lead to theft of session cookies, exposure of sensitive data in URLs, and potential compromise of your account or the application's internal structure.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. The exposure of session data and URL structures may result in non-compliance with data confidentiality and integrity mandates.

Mitigation Strategies

Upgrade wger to version 2.6 or later immediately. If upgrading is not possible, apply a patch to validate the 'next' parameter using Django's url_has_allowed_host_and_scheme() function in the trainer_login view.

Restrict trainer roles to trusted users only. Monitor network traffic for suspicious redirects or phishing attempts targeting trainers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86256. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart