CVE-2026-45161: wger trainer_login CSRF bypass via GET request

CVE-2026-45161 · Severity: medium · CVSS 5.4 · Published 2026-10-07

wger is a fitness and gym management web application. The trainer_login feature accepts unsafe GET requests without CSRF protection, allowing an attacker to force an authenticated trainer's session to rebind to an arbitrary user account by embedding an image on a malicious page. When the trainer loads that page, their browser automatically makes the request with their session cookie, giving the attacker impersonation of any gym user.

Technologies: wger (PyPI), Wger. Vendors: PyPI, Wger.

Quick answers

Is CVE-2026-45161 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45161 being exploited in the wild.
How severe is CVE-2026-45161?
Medium severity, with a CVSS score of 5.4, published 7 October 2026.
Which products and versions are affected?
wger (PyPI) <= 2.1, ECOSYSTEM:introduced=0,last_affected=2.1.
Is there a fix for CVE-2026-45161?
No fixed version is recorded yet. Apply the suggested patch: add @require_POST decorator to the trainer_login view and move the ?next= parameter from GET to POST with proper URL validation using url_has_allowed_host_and_scheme to prevent open redirect attacks in combination with this CSRF vector.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-07"}, {"kind": "advisory", "at": "2026-10-07"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45161 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-45161?
Check whether you run wger (PyPI) or Wger at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Apply the suggested patch: add @require_POST decorator to the trainer_login view and move the ?next= parameter from GET to POST with proper URL validation using url_has_allowed_host_and_scheme to prevent open redirect attacks in combination with this CSRF vector.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-07"}, {"kind": "advisory", "at": "2026-10-07"}]

Technical details

The trainer_login view in wger/core/views/user.py executes Django's login function on GET requests, bypassing CSRF middleware which only validates tokens on unsafe methods (POST/PUT/PATCH/DELETE). An attacker can exploit this via an image tag that triggers a same-origin session rebinding through the server's own ?next= redirect chain, circumventing SameSite=Lax restrictions. The fix requires adding @require_POST decorator and moving the next parameter to POST body with validation.

Affected products

  • wger wger

Identifiers

  • CVE-2026-45161
  • GHSA-xf64-4pmc-h8qf
  • PYSEC-2026-4317

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.