66664 matches found
CVE-2026-46437
wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...
tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination
A flaw was found in Apache Tomcat. This vulnerability, categorized as Insufficient Session Expiration, occurs when an authenticated HTTP session's ID is modified after a WebSocket connection has been established. Under these conditions, the WebSocket session fails to terminate as expected when th...
wger: API credentials remain valid after logout/password change
Summary A vulnerability exists in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken Authorization: Token ... or JWT refresh token can continue ...
GHSA-V3X9-6GG8-C2C9 wger: API credentials remain valid after logout/password change
Summary A vulnerability exists in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken Authorization: Token ... or JWT refresh token can continue ...
Insufficient Session Expiration
Overview Affected versions of this package are vulnerable to Insufficient Session Expiration via the authentication lifecycle in wger/core/views/user.py and the API token management in wger/utils/apitoken.py, where bearer-style API credentials are not revoked on logout or password change. The...
CVE-2026-46437 wger: API credentials remain valid after logout/password change
wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...
CVE-2026-46437
The open-source fitness manager wger contains a vulnerability in its authentication and session lifecycle affecting versions prior to 2.6 . Specifically, bearer-style API credentials —including DRF authtokens and JWT refresh tokens —remain valid even after a user performs a logout or a password c...
EUVD-2026-94334
wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...
CVE-2026-46437 wger: API credentials remain valid after logout/password change
wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...
CVE-2026-46437
wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of "wger" where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DR...
GHSA-XF64-4PMC-H8QF wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding
Summary The trainerlogin view in wger accepts GET requests and executes djangologin without any CSRF protection, because Django's CsrfViewMiddleware only enforces tokens on unsafe methods POST/PUT/PATCH/DELETE. An attacker can embed a single tag on a malicious page; when an authenticated trainer...
wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding
Summary The trainerlogin view in wger accepts GET requests and executes djangologin without any CSRF protection, because Django's CsrfViewMiddleware only enforces tokens on unsafe methods POST/PUT/PATCH/DELETE. An attacker can embed a single tag on a malicious page; when an authenticated trainer...
Cross-site Request Forgery (CSRF)
Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the trainerlogin view in wger/core/views/user.py, which accepts GET requests and calls djangologin without any CSRF protection. Because Django's CsrfViewMiddleware only enforces token validation on...
CVE-2026-45161 wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding
wger is a free, open-source workout and fitness manager. Prior to version 2.6, the trainerlogin view in wger accepts GET requests and executes djangologin without any CSRF protection, because Django's CsrfViewMiddleware only enforces tokens on unsafe methods POST/PUT/PATCH/DELETE. An attacker can...
EUVD-2026-94331
wger is a free, open-source workout and fitness manager. Prior to version 2.6, the trainerlogin view in wger accepts GET requests and executes djangologin without any CSRF protection, because Django's CsrfViewMiddleware only enforces tokens on unsafe methods POST/PUT/PATCH/DELETE. An attacker can...
CVE-2026-45161
wger is a free, open-source workout and fitness manager. Prior to version 2.6, the "trainerlogin" view in wger accepts GET requests and executes "djangologin" without any CSRF protection, because Django's "CsrfViewMiddleware" only enforces tokens on unsafe methods POST/PUT/PATCH/DELETE. An attack...
CVE-2026-45161
The wger fitness manager (prior to version 2.6 ) is vulnerable to a CSRF attack because the trainer_login view (located in wger/core/views/user.py) accepts GET requests. Since Django's CsrfViewMiddleware only enforces tokens on unsafe methods like POST, an attacker can use a malicious `
CVE-2026-45161 wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding
wger is a free, open-source workout and fitness manager. Prior to version 2.6, the trainerlogin view in wger accepts GET requests and executes djangologin without any CSRF protection, because Django's CsrfViewMiddleware only enforces tokens on unsafe methods POST/PUT/PATCH/DELETE. An attacker can...
CVE-2026-45161 wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding
wger is a free, open-source workout and fitness manager. Prior to version 2.6, the trainerlogin view in wger accepts GET requests and executes djangologin without any CSRF protection, because Django's CsrfViewMiddleware only enforces tokens on unsafe methods POST/PUT/PATCH/DELETE. An attacker can...
tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination
A flaw was found in Apache Tomcat. This vulnerability, categorized as Insufficient Session Expiration, occurs when an authenticated HTTP session's ID is modified after a WebSocket connection has been established. Under these conditions, the WebSocket session fails to terminate as expected when th...