CVE-2026-86256: wger Open Redirect Vulnerability

CVE-2026-86256 Overview

CVE-2026-86256 is an open redirect vulnerability [CWE-601] in wger, an open-source fitness and workout management application. The flaw resides in the trainer_login view (wger/core/views/user.py) and affects all versions up to and including 2.5.0. After a trainer enters impersonation mode, the view passes the user-supplied next GET parameter directly to HttpResponseRedirect() without invoking url_has_allowed_host_and_scheme() for validation. An attacker who delivers a crafted link to an authenticated trainer can redirect the browser to an attacker-controlled domain.

Critical Impact
Attackers can weaponize trusted wger URLs for phishing campaigns and leak the impersonated user's user_pk and wger URL structure through the Referer header sent to the attacker's domain.

Affected Products

wger versions <= 2.5.0
wger trainer_login view in wger/core/views/user.py
Deployments patched in wger 2.6 and later

Discovery Timeline

2026-09-06 - CVE-2026-86256 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86256

Vulnerability Analysis

The vulnerability exists in the trainer impersonation workflow. When a trainer initiates impersonation mode, the trainer_login view accepts a next parameter from the query string and forwards the browser to that destination. Django provides url_has_allowed_host_and_scheme() specifically to validate redirect targets against a trusted host allowlist, but the vulnerable code path omits this check. Any absolute URL supplied by the attacker becomes a valid redirect target.

Because the redirect originates from an authenticated action inside the wger application, the attacker gains two advantages. First, the landing URL appears trustworthy to the trainer because it starts on the legitimate wger host. Second, the browser transmits the pre-redirect wger URL, including the impersonated user's user_pk, in the Referer header when it reaches the attacker's site.

Root Cause

The root cause is missing validation of user-controlled redirect input, a canonical instance of CWE-601: URL Redirection to Untrusted Site. The trainer_login view trusts the next GET parameter and constructs an HttpResponseRedirect() without confirming the target host matches the application's allowlist.

Attack Vector

Exploitation requires an authenticated trainer to click a crafted link. The attacker constructs a URL pointing at the wger trainer_login endpoint with a next parameter referencing an attacker-controlled host. Once the trainer follows the link and impersonation completes, the browser silently redirects to the malicious destination. The attacker can then host a cloned wger login page to harvest credentials, or capture the Referer header to enumerate internal user identifiers.

Refer to the GitHub Security Advisory GHSA-vqv8-j3mj-wjxj and the VulnCheck Advisory for Open Redirect for full technical details.

Detection Methods for CVE-2026-86256

Indicators of Compromise

Requests to /user/trainer-login/ or the trainer_login route with a next parameter containing an absolute URL or a host outside the wger deployment.
Outbound Referer headers from trainer browsers referencing wger URLs that include user_pk values sent to unfamiliar external domains.
Repeated crafted links delivered to trainer email addresses that URL-encode external hosts in the next parameter.

Detection Strategies

Inspect web server and application access logs for next parameter values that begin with http://, https://, //, or contain encoded schemes such as %2F%2F.
Correlate trainer impersonation events with subsequent 302 responses whose Location header targets a non-allowlisted host.
Alert on user-reported phishing pages that mimic wger login screens, which may indicate active exploitation.

Monitoring Recommendations

Enable verbose logging on the trainer_login view and forward events to a centralized log platform for retention and analysis.
Baseline the domains referenced in redirect Location headers and alert on deviations.
Monitor authentication events for trainer accounts that report unexpected logout or credential prompts shortly after clicking internal links.

How to Mitigate CVE-2026-86256

Immediate Actions Required

Upgrade wger to version 2.6 or later, which validates the next parameter with url_has_allowed_host_and_scheme().
Audit trainer accounts for suspicious activity that occurred after clicking trainer_login links containing external next values.
Notify trainers about the phishing risk and instruct them to verify the browser address bar after impersonation flows complete.

Patch Information

The wger project addressed the flaw in release 2.6. The fix adds a call to Django's url_has_allowed_host_and_scheme() inside the trainer_login view in wger/core/views/user.py, restricting redirects to hosts allowed by the deployment. Administrators should follow the upgrade guidance in the GitHub Security Advisory GHSA-vqv8-j3mj-wjxj.

Workarounds

Deploy a reverse proxy or web application firewall rule that strips or rejects requests to trainer_login when the next parameter references an external host.
Restrict trainer accounts to trusted networks and enforce multi-factor authentication to reduce credential-phishing impact.
Configure browsers or corporate policy to send a minimal Referer header for the wger origin, limiting user_pk leakage until patching completes.

bash

# Upgrade wger to a patched release
pip install --upgrade 'wger>=2.6'

# Verify the installed version
python -c "import wger; print(wger.__version__)"