CVE-2026-86256

wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect() without validating it with url_has_allowed_host_and_scheme(). An attacker who delivers a crafted link to an authenticated trainer can redirect the trainer's browser to an attacker-controlled domain, enabling phishing and leaking the wger URL structure (including the impersonated user's user_pk) via the Referer header.

• CWE-601

• https://github.com/wger-project/wger/security/advisories/GHSA-vqv8-j3mj-wjxj
• https://www.vulncheck.com/advisories/wger-before-2.6-open-redirect-via-trainer-login-next-parameter

Published

Sep 6, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86250h3 versions before 2.0.1-rc.18 fail to validate the chunk co…7.5
• CVE-2026-86251h3 versions before 1.15.9 contain a path traversal vulnerabi…5.9
• CVE-2026-86252h3 versions before 1.15.9 fail to sanitize carriage return c…5.3
• CVE-2026-86253h3 (npm package) versions <= 2.0.1-rc.14 contain a path trav…5.9
• CVE-2026-86254wger versions through master contain an incomplete authoriza…6.8
• CVE-2026-86255wger before 2.5 fails to validate the maximum duration of ro…6.5
• CVE-2026-86257wger before 2.6 fails to sanitize first_name and last_name f…5.4
• CVE-2026-86258nbviewer through 1.0.1 contains a path traversal vulnerabili…5.9
• CVE-2026-86259OpenMAIC before 1.0.1 skips server-side request forgery vali…7.5
• CVE-2026-8626The SponsorMe plugin for WordPress is vulnerable to Reflecte…6.1
• CVE-2026-86260A security flaw has been discovered in sfturing hosp_order u…6.5
• CVE-2026-86261A weakness has been identified in sfturing hosp_order up to …7.3