PYSEC-2026-4315 wger: API credentials remain valid after logout/password change

Summary A vulnerability exists in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken Authorization: Token ... or JWT refresh token can continue ...

wger: API credentials remain valid after logout/password change

SummaryA vulnerability exists in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken Authorization: Token ... or JWT refresh token can continue t...

CVE-2026-46437

wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...

wger: API credentials remain valid after logout/password change

Summary A vulnerability exists in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken Authorization: Token ... or JWT refresh token can continue ...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration via the authentication lifecycle in wger/core/views/user.py and the API token management in wger/utils/apitoken.py, where bearer-style API credentials are not revoked on logout or password change. The...

GHSA-V3X9-6GG8-C2C9 wger: API credentials remain valid after logout/password change

Summary A vulnerability exists in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken Authorization: Token ... or JWT refresh token can continue ...

CVE-2026-46437 wger: API credentials remain valid after logout/password change

wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...

CVE-2026-46437

The open-source fitness manager wger contains a vulnerability in its authentication and session lifecycle affecting versions prior to 2.6 . Specifically, bearer-style API credentials —including DRF authtokens and JWT refresh tokens —remain valid even after a user performs a logout or a password c...

CVE-2026-46437 wger: API credentials remain valid after logout/password change

wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...

CVE-2026-46437 wger: API credentials remain valid after logout/password change

wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...

CVE-2026-46437

wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of "wger" where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DR...

PT-2026-107515

Name of the Vulnerable Software and Affected Versions wger versions prior to 2.6 Description A flaw in the authentication and session lifecycle allows bearer-style API credentials to remain valid after a user logs out or changes their password. An attacker who obtains a victim's DRF authtoken or...

CVE-2026-46437: Improper Authentication

wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...

aiohttp-ext-auth (>=0.1.1, <=0.1.2), ais-dom (>=0.76.5, <=0.91.5) +34 more potentially affected by CVE-2026-102269 via pyjwt (1.6.4)

pyjwt PYPI version 1.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aiohttp-ext-auth =0.1.1, =0.76.5, =0.0.1, =0.0.1, =0.4.0, =1.0.0, =0.0.19, =0.5.0, =1.1.7, =0.31.0, =0.0.1, =0.0.2, =0.1.0 and more Source cves:...

django-rstblog (>=0.1.0, <=0.1.1), drf-user (0.0.1) +2 more potentially affected by CVE-2026-15307 via django (2.0.7)

django PYPI version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rstblog =0.1.0, =0.1.1 - drf-user 0.0.1 - drfaddons 0.0.3 - umap-project 1.0.0rc1 Source cves: CVE-2026-15307 Source advisory:...

cosmicdbsemantic (>=0.0.1, <=0.0.23), drf-account (0.0.1) +3 more potentially affected by CVE-2026-15307 via django (2.0.5)

django PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cosmicdbsemantic =0.0.1, =0.9.2, =0.9.5 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

drf-tus (1.21.1), richie (0.1.0) potentially affected by CVE-2026-15307 via django (1.11.14)

django PYPI version 1.11.14 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - drf-tus 1.21.1 - richie 0.1.0 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

django-oscar-moysklad (>=0.2.0, <=0.2.3), drf-paytm (0.0.1) +3 more potentially affected by CVE-2026-15307 via django (2.1.3)

django PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-oscar-moysklad =0.2.0, =1.4.3, =1.6.5 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

CVE-2026-71459

The Red Hat Ansible Automation Platform (automation-controller ) is vulnerable to a cross-tenant job event data exposure due to a missing RBAC check in the JobJobEventsChildrenSummary view. The underlying cause is that the view lacks a model/parent_model definition, causing ModelAccessPermission....

CVE-2026-71459 Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structure

JobJobEventsChildrenSummary view has no model/parentmodel. ModelAccessPermission.checkgetpermissions falls through returns True for any authenticated user. The view uses raw getobjector404Job, pk without DRF object-level permission check. Zero-privilege user reads event tree structure,...