PT-2026-41506

Summary The trainer login view in wger redirects to request.GET'next' directly via HttpResponseRedirect without calling url has allowed host and scheme. After the trainer successfully enters impersonation mode, their browser is redirected to any attacker-controlled URL supplied in the ?next=...