PYSEC-2026-4315 wger: API credentials remain valid after logout/password change

Summary A vulnerability exists in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken Authorization: Token ... or JWT refresh token can continue ...

CVE-2026-46437

wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...

GHSA-V3X9-6GG8-C2C9 wger: API credentials remain valid after logout/password change

Summary A vulnerability exists in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken Authorization: Token ... or JWT refresh token can continue ...

wger: API credentials remain valid after logout/password change

Summary A vulnerability exists in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken Authorization: Token ... or JWT refresh token can continue ...

CVE-2026-46437 wger: API credentials remain valid after logout/password change

wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...

CVE-2026-46437 wger: API credentials remain valid after logout/password change

wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...

CVE-2026-46437

The open-source fitness manager wger contains a vulnerability in its authentication and session lifecycle affecting versions prior to 2.6 . Specifically, bearer-style API credentials —including DRF authtokens and JWT refresh tokens —remain valid even after a user performs a logout or a password c...

PT-2026-107515

Name of the Vulnerable Software and Affected Versions wger versions prior to 2.6 Description A flaw in the authentication and session lifecycle allows bearer-style API credentials to remain valid after a user logs out or changes their password. An attacker who obtains a victim's DRF authtoken or...

CVE-2026-46437: Improper Authentication

wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...