CVE-2026-46437

wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of `wger` where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken (`Authorization: Token ...`) or JWT refresh token can continue to access protected `/api/v2/*` endpoints until the token is manually rotated/deleted (DRF token) or naturally expires (JWT refresh). Version 2.6 contains a patch.

• CWE-287
• CWE-613

• https://github.com/wger-project/wger/releases/tag/2.6
• https://github.com/wger-project/wger/security/advisories/GHSA-v3x9-6gg8-c2c9
• https://github.com/wger-project/wger/security/advisories/GHSA-v3x9-6gg8-c2c9

Published

Oct 7, 2026

Last Modified

Oct 10, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4643Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to…3.5
• CVE-2026-46430Algernon is a small self-contained pure-Go web server. Prior…4.3
• CVE-2026-46431Algernon is a small self-contained pure-Go web server. Prior…4.3
• CVE-2026-46432LMDeploy is a toolkit for compressing, deploying, and servin…7.8
• CVE-2026-46433lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to …6.5
• CVE-2026-46434wger is a free, open-source workout and fitness manager. Pri…7.1
• CVE-2026-46438wger is a free, open-source workout and fitness manager. Pri…6.5
• CVE-2026-46439compliance-trestle is a tooling platform for managing compli…7.8
• CVE-2026-4644A Missing Authorization vulnerability in HTTP Connector in G…8.5
• CVE-2026-46440Flowise is a drag & drop user interface to build a customize…9.1
• CVE-2026-46441Flowise is a drag & drop user interface to build a customize…9.6
• CVE-2026-46442Flowise is a drag & drop user interface to build a customize…9.9