CVE-2026-46437

wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...

CVE-2026-46437

The open-source fitness manager wger contains a vulnerability in its authentication and session lifecycle affecting versions prior to 2.6 . Specifically, bearer-style API credentials —including DRF authtokens and JWT refresh tokens —remain valid even after a user performs a logout or a password c...