# CVE-2026-86256: wger trainer_login open redirect in next parameter

Source: https://junglewise.ai/threats/cve-2026-86256-wger-trainer-login-open-redirect-in-next-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-06. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86256 · Severity: medium · CVSS 5.4 · Published 2026-09-06

wger is a web-based fitness and gym management application used by trainers to manage client workouts and impersonation sessions. The trainer_login view fails to validate the redirect destination after a trainer enables impersonation mode, allowing an attacker to redirect the trainer to a malicious website. This can enable phishing attacks and leak sensitive information such as the impersonated user's ID through the browser's referrer header.

Technologies: [wger (PyPI)](https://junglewise.ai/threats/technologies/wger). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-86256 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86256 being exploited in the wild.

**How severe is CVE-2026-86256?** Medium severity, with a CVSS score of 5.4, published 6 September 2026.

**Which products and versions are affected?** wger (PyPI) ECOSYSTEM:introduced=0,fixed=2.6.

**Is there a fix for CVE-2026-86256?** Yes. wger (PyPI): upgrade to 2.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86256 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86256?** Check whether you run wger (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- wger (PyPI): upgrade to 2.6 or later

  ```sh
  pip install "wger>=2.6"
  ```


## Technical details

The vulnerability is an open redirect (CWE-601) in the trainer_login view (wger/core/views/user.py, line 203) that fails to validate the 'next' GET parameter before redirecting via HttpResponseRedirect(). The vulnerable code performs no call to Django's url_has_allowed_host_and_scheme() function to ensure the redirect target is on the same host. An authenticated trainer with gym trainer permissions can be exploited by clicking a crafted link (e.g., /en/user/2/trainer-login?next=https://evil.example/steal). When the trainer enters impersonation mode, the view redirects to the attacker-controlled URL, leaking the impersonated user's user_pk via the Referer header. The fix involves adding host and scheme validation before the redirect. Patched in wger 2.6 and later.

## Affected products

- wger wger <= 2.5.0

## Identifiers

- CVE-2026-86256
- GHSA-vqv8-j3mj-wjxj

## Timeline

- 2026-04-28: disclosed: GitHub Security Advisory published
- 2026-09-06: advisory: NVD and public advisory published
- 2026: patched: Fixed in wger 2.6 and later

## References

- [https://github.com/wger-project/wger/security/advisories/GHSA-vqv8-j3mj-wjxj](https://github.com/wger-project/wger/security/advisories/GHSA-vqv8-j3mj-wjxj)
- [https://www.vulncheck.com/advisories/wger-before-2.6-open-redirect-via-trainer-login-next-parameter](https://www.vulncheck.com/advisories/wger-before-2.6-open-redirect-via-trainer-login-next-parameter)

## Related threats

- [wger authorization bypass in workout log entry creation](https://junglewise.ai/threats/cve-2026-46438-wger-cross-user-data-corruption-via-missing-ownership-check-on)
- [wger Trainer privilege escalation in user deactivation](https://junglewise.ai/threats/cve-2026-46434-wger-trainer-privilege-escalation-improper-privilege-management)
- [wger API credentials remain valid after logout/password change](https://junglewise.ai/threats/cve-2026-46437-wger-api-credentials-remain-valid-after-logout-password-change)
- [wger trainer_login CSRF bypass via GET request](https://junglewise.ai/threats/cve-2026-45161-wger-trainer-login-accepts-get-csrf-bypass-enables-forced-session)
- [wger gym-scope guard bypass allows cross-tenant admin notes leak](https://junglewise.ai/threats/cve-2026-43976-wger-cross-tenant-admin-notes-contracts-leak-via-gym-none-bypass)