CVE-2026-46437

wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...

GHSA-V3X9-6GG8-C2C9 wger: API credentials remain valid after logout/password change

Summary A vulnerability exists in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken Authorization: Token ... or JWT refresh token can continue ...

wger: API credentials remain valid after logout/password change

Summary A vulnerability exists in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken Authorization: Token ... or JWT refresh token can continue ...

CVE-2026-46437 wger: API credentials remain valid after logout/password change

wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...

CVE-2026-46437

The open-source fitness manager wger contains a vulnerability in its authentication and session lifecycle affecting versions prior to 2.6 . Specifically, bearer-style API credentials —including DRF authtokens and JWT refresh tokens —remain valid even after a user performs a logout or a password c...

CVE-2026-46437 wger: API credentials remain valid after logout/password change

wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...

PT-2026-107515

wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...

CVE-2026-46437: Improper Authentication

wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...

The vulnerability of the /api/connections file of the JWT Refresh Token Handler software platform for automated file exchange with Cleo Harmony allows a malicious actor to escalate their privileges and gain unauthorized access to protected information.

The vulnerability of the /api/connections file of the JWT Refresh Token Handler component of the software platform for automated file exchange in Cleo Harmony is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to enhance their privileges and gain...

CVE-2026-84115

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...

CVE-2026-84115 Cleo Harmony JWT Refresh Token connections privileges management

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...

CVE-2026-84115 Cleo Harmony JWT Refresh Token connections privileges management

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...

CVE-2026-84115

Cleo Harmony versions up to 5.8.1.10 are affected by an improper privilege management vulnerability in the JWT Refresh Token Handler component within the /api/connections file. Manipulation of the Bearer argument allows a remote, unauthenticated attacker to gain excessive privileges, with the sco...

EUVD-2026-69383

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...

CVE-2026-84115: Improper Privilege Management

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...

PT-2026-84292

Name of the Vulnerable Software and Affected Versions Cleo Harmony versions 5.8.1.0 through 5.8.1.10 Description An issue exists in the JWT JSON Web Token refresh token handler within the /api/connections endpoint. A remote attacker can manipulate the Bearer argument in HTTP headers to bypass...

PT-2025-42635

Name of the Vulnerable Software and Affected Versions Flowise versions through 3.0.4 Description FlowiseAI is susceptible to remote code execution due to the lack of input sanitization within the "Supabase RPC Filter" component. An authenticated administrator can inject malicious payloads into th...