CVE-2026-46437 · GHSA-v3x9-6gg8-c2c9
wger: API credentials remain valid after logout/password change
- Risk score
- 41/100
- CVSS
- 4.8 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 7 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken (Authorizati…
- Affected
- wger (pip) <= 2.1
- Fix
- No patched version listed yet: check the advisory for mitigations.
- Exploitation
- Public proof of concept
Why it is Yellow
- CVSS 4.8 medium
- Public exploit or proof of concept referenced
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| wger | pip | <= 2.1 | No fix yet |
References
Original description
wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of `wger` where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken (`Authorization: Token ...`) or JWT refresh token can continue to access protected `/api/v2/*` endpoints until the token is manually rotated/deleted (DRF token) or naturally expires (JWT refresh). Version 2.6 contains a patch.
Last activity 7 Oct 2026. Patch Forecast updates every hour.