CVE-2026-46437 wger: API credentials remain valid after logout/password change
Attackers with stolen API tokens retain access after logout or password change, allowing unauthorized data access in wger fitness manager.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-46437?
CVE-2026-46437 is a medium-severity authentication bypass vulnerability in wger-project wger, published on 7 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of `wger` where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken (`Authorization: Token ...`) or JWT refresh token can continue to access protected `/api/v2/*` endpoints until the token is manually rotated/deleted (DRF token) or naturally expires (JWT refresh). Version 2.6 contains a patch.
Which versions are affected by CVE-2026-46437?
3 open source packages ship an affected version, including wger.
| Package | Affected | Fixed in |
|---|---|---|
wger PyPI | All versions to 2.1 | None |
wger PyPI | All versions to 2.1 | None |
wger PyPI | All versions to 2.1 | None |
How do I fix CVE-2026-46437?
No fix has been published for CVE-2026-46437 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-46437 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-46437 exists.
Sources
Also known as GHSA-v3x9-6gg8-c2c9, PYSEC-2026-4315.