https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-10T17:11:02.535441+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-46437 fkie_cve-2026-46437 2026-10-10T17:11:02.553252+00:00

wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of `wger` where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken (`Authorization: Token ...`) or JWT refresh token can continue to access protected `/api/v2/*` endpoints until the token is manually rotated/deleted (DRF token) or naturally expires (JWT refresh). Version 2.6 contains a patch.

 https://vulnerability.circl.lu/vuln/ghsa-v3x9-6gg8-c2c9 GHSA-v3x9-6gg8-c2c9 — wger: API credentials remain valid after logout/password change 2026-10-10T17:11:02.553394+00:00

Affected: PyPI: wger

### Summary

A vulnerability exists in the authentication/session lifecycle of `wger` where **bearer-style API credentials** remain valid **after a user logs out and after a user changes their password**. An attacker who steals a victim’s **DRF authtoken** (`Authorization: Token ...`) or **JWT refresh token** can continue to access protected `/api/v2/*` endpoints until the token is manually rotated/deleted (DRF token) or naturally expires (JWT refresh). lifecycle events do not revoke these credentials: - **Logout** (`/user/logout`) only clears the Django session cookie via `django_logout()` and does not revoke API tokens. - **Password change** updates the password hash, but does not revoke: - existing DRF tokens stored in `authtoken_token` - existing JWT refresh tokens (no server-side revocation list or token versioning); refresh can continue minting new access tokens until refresh expiry.

#### Vulnerable Files

- `wger/wger/core/views/user.py` (logout implementation) - `wger/settings/settings_global.py` (DRF auth configuration, SimpleJWT defaults) - `wger/settings/main.py` (commonly used production defaults for JWT lifetimes) - `wger/wger/utils/api_token.py` (authtoken rotation is manual only)

### PoC (Proof of Concept)

#### Manual Exploitation Steps

1. Create a user account. 2. Obtain a JWT refresh token: - `POST /api/v2/token` with username/password. 3. Obtain a DRF token (API key): - use `/user/api-key` (or create token via admin/DB in a test environment).…