https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 17:11:02 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-46437 <p>wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of `wger` where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken (`Authorization: Token ...`) or JWT refresh token can continue to access protected `/api/v2/*` endpoints until the token is manually rotated/deleted (DRF token) or naturally expires (JWT refresh). Version 2.6 contains a patch.</p> <p>wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of `wger` where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken (`Authorization: Token ...`) or JWT refresh token can continue to access protected `/api/v2/*` endpoints until the token is manually rotated/deleted (DRF token) or naturally expires (JWT refresh). Version 2.6 contains a patch.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-46437 https://vulnerability.circl.lu/vuln/ghsa-v3x9-6gg8-c2c9 <p><strong>Affected:</strong> PyPI: wger</p> <p>### Summary</p> <p>A vulnerability exists in the authentication/session lifecycle of `wger` where **bearer-style API credentials** remain valid **after a user logs out and after a user changes their password**. An attacker who steals a victim’s **DRF authtoken** (`Authorization: Token ...`) or **JWT refresh token** can continue to access protected `/api/v2/*` endpoints until the token is manually rotated/deleted (DRF token) or naturally expires (JWT refresh). lifecycle events do not revoke these credentials: - **Logout** (`/user/logout`) only clears the Django session cookie via `django_logout()` and does not revoke API tokens. - **Password change** updates the password hash, but does not revoke: - existing DRF tokens stored in `authtoken_token` - existing JWT refresh tokens (no server-side revocation list or token versioning); refresh can continue minting new access tokens until refresh expiry.</p> <p>#### Vulnerable Files</p> <p>- `wger/wger/core/views/user.py` (logout implementation) - `wger/settings/settings_global.py` (DRF auth configuration, SimpleJWT defaults) - `wger/settings/main.py` (commonly used production defaults for JWT lifetimes) - `wger/wger/utils/api_token.py` (authtoken rotation is manual only)</p> <p>### PoC (Proof of Concept)</p> <p>#### Manual Exploitation Steps</p> <p>1. Create a user account. 2. Obtain a JWT refresh token: - `POST /api/v2/token` with username/password. 3. Obtain a DRF token (API key): - use `/user/api-key` (or create token via admin/DB in a test environment).…</p> <p><strong>Affected:</strong> PyPI: wger</p> <p>### Summary</p> <p>A vulnerability exists in the authentication/session lifecycle of `wger` where **bearer-style API credentials** remain valid **after a user logs out and after a user changes their password**. An attacker who steals a victim’s **DRF authtoken** (`Authorization: Token ...`) or **JWT refresh token** can continue to access protected `/api/v2/*` endpoints until the token is manually rotated/deleted (DRF token) or naturally expires (JWT refresh). lifecycle events do not revoke these credentials: - **Logout** (`/user/logout`) only clears the Django session cookie via `django_logout()` and does not revoke API tokens. - **Password change** updates the password hash, but does not revoke: - existing DRF tokens stored in `authtoken_token` - existing JWT refresh tokens (no server-side revocation list or token versioning); refresh can continue minting new access tokens until refresh expiry.</p> <p>#### Vulnerable Files</p> <p>- `wger/wger/core/views/user.py` (logout implementation) - `wger/settings/settings_global.py` (DRF auth configuration, SimpleJWT defaults) - `wger/settings/main.py` (commonly used production defaults for JWT lifetimes) - `wger/wger/utils/api_token.py` (authtoken rotation is manual only)</p> <p>### PoC (Proof of Concept)</p> <p>#### Manual Exploitation Steps</p> <p>1. Create a user account. 2. Obtain a JWT refresh token: - `POST /api/v2/token` with username/password. 3. Obtain a DRF token (API key): - use `/user/api-key` (or create token via admin/DB in a test environment).…</p> https://vulnerability.circl.lu/vuln/ghsa-v3x9-6gg8-c2c9