Insufficient Session Expiration in wger - CVE-2026-46437
Published: November 9, 2026
Vulnerability identifier: #VU163190
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-46437
CWE-ID: CWE-613
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to retain access to a victim’s private API data and modify account data after logout or password change.
The vulnerability exists due to missing revocation of DRF authentication tokens and JWT refresh tokens during wger’s logout and password change workflows. An unauthenticated remote attacker can replay a stolen DRF token or use a stolen JWT refresh token to obtain access tokens and continue accessing protected API endpoints.
Affected software
wger
How to mitigate CVE-2026-46437
Install security update from vendor's website.
wger - update to 2.6