CVE-2026-86256

Name of the Vulnerable Software and Affected Versions wger versions prior to 2.6

Description The trainer login view in wger/core/views/user.py allows an open redirect. This occurs when a trainer enters impersonation mode and the view redirects to the next GET parameter using HttpResponseRedirect() without validating it via url has allowed host and scheme(). An attacker can use a crafted link to redirect an authenticated trainer to an external domain, which may lead to phishing or the leakage of the internal URL structure, including the user pk of the impersonated user, through the Referer header.

Recommendations Update wger to version 2.6 or later.