{"id":"CVE-2026-86256","title":"wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py)","summary":"wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET param…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-601"],"vendor":"wger-project","product":"wger","affected":["wger < 2.6"],"published":"2026-09-06","updated":"2026-09-09","sourceUpdated":"2026-09-09T14:17:22.100","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86256","references":[{"url":"https://github.com/wger-project/wger/security/advisories/GHSA-vqv8-j3mj-wjxj","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/wger-before-2.6-open-redirect-via-trainer-login-next-parameter","label":"disclosure@vulncheck.com"},{"url":"https://github.com/wger-project/wger/security/advisories/GHSA-vqv8-j3mj-wjxj","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/wger-project/wger"}],"tags":["nvd","cve.org","exploit-available","osv","pip"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T13:59:00.688174Z"},"epss":0.0018,"epssPercentile":0.07861,"ingestedAt":"2026-09-07T04:04:50.761Z","aliases":["GHSA-vqv8-j3mj-wjxj"],"ecosystem":"pip","patched":["wger 2.6"],"slug":"CVE-2026-86256","body":"## Overview\n\nwger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect() without validating it with url_has_allowed_host_and_scheme(). An attacker who delivers a crafted link to an authenticated trainer can redirect the trainer's browser to an attacker-controlled domain, enabling phishing and leaking the wger URL structure (including the impersonated user's user_pk) via the Referer header.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-86256)\n\nAffected packages:\n\n- `wger < 2.6`\n\nPatched in:\n\n- `wger 2.6`\n\nSource: https://osv.dev/vulnerability/GHSA-vqv8-j3mj-wjxj","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":202103,"id":"CVE-2026-86256","ts":1789400062679,"field":"exploit_available","old":"false","new":"true"},{"seq":200830,"id":"CVE-2026-86256","ts":1789397616660,"field":"exploit_available","old":"true","new":"false"},{"seq":199523,"id":"CVE-2026-86256","ts":1789395529202,"field":"exploit_available","old":"false","new":"true"},{"seq":198768,"id":"CVE-2026-86256","ts":1789392244405,"field":"exploit_available","old":"true","new":"false"},{"seq":197101,"id":"CVE-2026-86256","ts":1789384292656,"field":"exploit_available","old":"false","new":"true"},{"seq":194230,"id":"CVE-2026-86256","ts":1789378783317,"field":"exploit_available","old":"true","new":"false"},{"seq":193017,"id":"CVE-2026-86256","ts":1789376515355,"field":"exploit_available","old":"false","new":"true"},{"seq":191804,"id":"CVE-2026-86256","ts":1789373631349,"field":"exploit_available","old":"true","new":"false"},{"seq":190589,"id":"CVE-2026-86256","ts":1789369475995,"field":"exploit_available","old":"false","new":"true"},{"seq":189376,"id":"CVE-2026-86256","ts":1789368419255,"field":"exploit_available","old":"true","new":"false"},{"seq":188159,"id":"CVE-2026-86256","ts":1789365231044,"field":"exploit_available","old":"false","new":"true"},{"seq":186946,"id":"CVE-2026-86256","ts":1789363471516,"field":"exploit_available","old":"true","new":"false"},{"seq":185732,"id":"CVE-2026-86256","ts":1789361229402,"field":"exploit_available","old":"false","new":"true"},{"seq":184519,"id":"CVE-2026-86256","ts":1789358364017,"field":"exploit_available","old":"true","new":"false"},{"seq":182770,"id":"CVE-2026-86256","ts":1789354317452,"field":"exploit_available","old":"false","new":"true"},{"seq":181563,"id":"CVE-2026-86256","ts":1789353317944,"field":"exploit_available","old":"true","new":"false"},{"seq":180356,"id":"CVE-2026-86256","ts":1789350284985,"field":"exploit_available","old":"false","new":"true"},{"seq":179149,"id":"CVE-2026-86256","ts":1789348293180,"field":"exploit_available","old":"true","new":"false"},{"seq":177942,"id":"CVE-2026-86256","ts":1789346370293,"field":"exploit_available","old":"false","new":"true"},{"seq":176735,"id":"CVE-2026-86256","ts":1789343184763,"field":"exploit_available","old":"true","new":"false"},{"seq":174852,"id":"CVE-2026-86256","ts":1789334875967,"field":"exploit_available","old":"false","new":"true"},{"seq":173647,"id":"CVE-2026-86256","ts":1789333693849,"field":"exploit_available","old":"true","new":"false"},{"seq":172461,"id":"CVE-2026-86256","ts":1789331093319,"field":"exploit_available","old":"false","new":"true"},{"seq":171275,"id":"CVE-2026-86256","ts":1789328781130,"field":"exploit_available","old":"true","new":"false"},{"seq":170070,"id":"CVE-2026-86256","ts":1789327197436,"field":"exploit_available","old":"false","new":"true"},{"seq":168865,"id":"CVE-2026-86256","ts":1789323840361,"field":"exploit_available","old":"true","new":"false"},{"seq":167660,"id":"CVE-2026-86256","ts":1789319702893,"field":"exploit_available","old":"false","new":"true"},{"seq":166455,"id":"CVE-2026-86256","ts":1789318776386,"field":"exploit_available","old":"true","new":"false"},{"seq":165250,"id":"CVE-2026-86256","ts":1789315790882,"field":"exploit_available","old":"false","new":"true"},{"seq":164045,"id":"CVE-2026-86256","ts":1789313634518,"field":"exploit_available","old":"true","new":"false"},{"seq":162840,"id":"CVE-2026-86256","ts":1789311903731,"field":"exploit_available","old":"false","new":"true"},{"seq":161635,"id":"CVE-2026-86256","ts":1789308733447,"field":"exploit_available","old":"true","new":"false"},{"seq":159748,"id":"CVE-2026-86256","ts":1789300470824,"field":"exploit_available","old":"false","new":"true"},{"seq":156737,"id":"CVE-2026-86256","ts":1789294755941,"field":"exploit_available","old":"true","new":"false"},{"seq":155532,"id":"CVE-2026-86256","ts":1789292968213,"field":"exploit_available","old":"false","new":"true"},{"seq":154327,"id":"CVE-2026-86256","ts":1789289797836,"field":"exploit_available","old":"true","new":"false"},{"seq":151578,"id":"CVE-2026-86256","ts":1789277630128,"field":"exploit_available","old":"false","new":"true"},{"seq":150539,"id":"CVE-2026-86256","ts":1789276246007,"field":"exploit_available","old":"true","new":"false"},{"seq":149506,"id":"CVE-2026-86256","ts":1789273824986,"field":"exploit_available","old":"false","new":"true"},{"seq":148473,"id":"CVE-2026-86256","ts":1789271348988,"field":"exploit_available","old":"true","new":"false"},{"seq":146504,"id":"CVE-2026-86256","ts":1789269398306,"field":"exploit_available","old":"false","new":"true"},{"seq":145309,"id":"CVE-2026-86256","ts":1789266340134,"field":"exploit_available","old":"true","new":"false"},{"seq":144213,"id":"CVE-2026-86256","ts":1789262617011,"field":"exploit_available","old":"false","new":"true"},{"seq":143117,"id":"CVE-2026-86256","ts":1789261533681,"field":"exploit_available","old":"true","new":"false"},{"seq":141948,"id":"CVE-2026-86256","ts":1789258832092,"field":"exploit_available","old":"false","new":"true"},{"seq":140789,"id":"CVE-2026-86256","ts":1789256727389,"field":"exploit_available","old":"true","new":"false"},{"seq":139591,"id":"CVE-2026-86256","ts":1789254832337,"field":"exploit_available","old":"false","new":"true"},{"seq":138393,"id":"CVE-2026-86256","ts":1789251934462,"field":"exploit_available","old":"true","new":"false"},{"seq":137195,"id":"CVE-2026-86256","ts":1789247833057,"field":"exploit_available","old":"false","new":"true"},{"seq":135997,"id":"CVE-2026-86256","ts":1789247056297,"field":"exploit_available","old":"true","new":"false"}]}