CVE-2026-86256

    Dashboard / Vulnerabilities / CVE-2026-86256

    CVE-2026-86256

    Published: 6 Sept 2026Last Modified: 11 Sept 2026

    Summary: wger before 2.6 Open Redirect via trainer-login next parameter

    Details: wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect() without validating it with url_has_allowed_host_and_scheme(). An attacker who delivers a crafted link to an authenticated trainer can redirect the trainer's browser to an attacker-controlled domain, enabling phishing and leaking the wger URL structure (including the impersonated user's user_pk) via the Referer header.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86256.json, https://github.com/wger-project/wger/security/advisories/GHSA-vqv8-j3mj-wjxj, https://nvd.nist.gov/vuln/detail/CVE-2026-86256, https://www.vulncheck.com/advisories/wger-before-2.6-open-redirect-via-trainer-login-next-parameter

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -e1d70bcc38cd56ae4a254dca1713c404d069f319

    Affected versions

    2.5

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-86256 | CVE-DB