wger: API credentials remain valid after logout/password change

{
  "id": "0f6ed83f7f101cc7de196d805874a670a6e3d7c1927a009042fe29deec38411f",
  "url": "https://osv.dev/vulnerability/GHSA-v3x9-6gg8-c2c9",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "wger: API credentials remain valid after logout/password change",
    "summary": "### Summary A vulnerability exists in the authentication/session lifecycle of `wger` where **bearer-style API credentials** remain valid **after a user logs out and after a user changes their password**. An attacker who steals a victim’s **DRF authtoken** (`Authorization: Token ...`) or **JWT refresh token** can continue to access protected `/api/v2/*` endpoints until the token is manually rotated/deleted (DRF token) or naturally expires (JWT refresh). lifecycle events do not revoke these credentials: - **Logout** (`/user/logout`) only clears the Django session cookie via `django_logout()` and does not revoke API tokens. - **Password change** updates the password hash, but does not revoke: - existing DRF tokens stored in `authtoken_token` - existing JWT refresh tokens (no server-side revocation list or token versioning); refresh can continue minting new access tokens until refresh expiry. #### Vulnerable Files - `wger/wger/core/views/user.py` (logout implementation) - `wger/settings/settings_global.py` (DRF auth configuration, SimpleJWT defaults) - `wger/settings/main.py` (commonly used production defaults for JWT lifetimes) - `wger/wger/utils/api_token.py` (authtoken rotation is manual only) ### PoC (Proof of Concept) #### Manual Exploitation Steps 1. Create a user account. 2. Obtain a JWT refresh token: - `POST /api/v2/token` with username/password. 3. Obtain a DRF token (API key): - use `/user/api-key` (or create token via admin/DB in a test environment). 4. Change passwor",
    "evidence": "osv:GHSA-v3x9-6gg8-c2c9",
    "products": [
      {
        "name": {
          "value": "wger",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.1.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.2",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.2rc1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.3",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.4",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.5",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.6",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.6.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.7",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.8",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.9",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.1",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "GHSA-v3x9-6gg8-c2c9",
      "aliases": [
        "CVE-2026-46437",
        "GHSA-v3x9-6gg8-c2c9",
        "PYSEC-2026-4315"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "2.1"
                }
              ]
            }
          ],
          "package": {
            "name": "wger",
            "purl": "pkg:pypi/wger",
            "ecosystem": "PyPI"
          },
          "versions": [
            "1.1",
            "1.1.1",
            "1.2",
            "1.2rc1",
            "1.3",
            "1.4",
            "1.5",
            "1.6",
            "1.6.1",
            "1.7",
            "1.8",
            "1.9",
            "2.0",
            "2.1"
          ],
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-v3x9-6gg8-c2c9/GHSA-v3x9-6gg8-c2c9.json"
          }
        }
      ],
      "modified": "2026-10-15T14:55:35.464579755Z",
      "provider": "osv",
      "references": [
        "https://github.com/wger-project/wger/security/advisories/GHSA-v3x9-6gg8-c2c9",
        "https://github.com/wger-project/wger",
        "https://github.com/wger-project/wger/releases/tag/2.6"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-287",
          "CWE-613"
        ],
        "severity": "MODERATE",
        "github_reviewed": true,
        "nvd_published_at": null,
        "github_reviewed_at": "2026-10-07T13:59:10Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-46437",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 332665,
  "published_at": "2026-10-07T13:59:10+00:00"
}

{
  "id": "760ee7a034cbb70dba32098887967d7dcde3c834b23800773ba0e8480890b74f",
  "url": "https://osv.dev/vulnerability/PYSEC-2026-4315",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "wger: API credentials remain valid after logout/password change",
    "summary": "### Summary A vulnerability exists in the authentication/session lifecycle of `wger` where **bearer-style API credentials** remain valid **after a user logs out and after a user changes their password**. An attacker who steals a victim’s **DRF authtoken** (`Authorization: Token ...`) or **JWT refresh token** can continue to access protected `/api/v2/*` endpoints until the token is manually rotated/deleted (DRF token) or naturally expires (JWT refresh). lifecycle events do not revoke these credentials: - **Logout** (`/user/logout`) only clears the Django session cookie via `django_logout()` and does not revoke API tokens. - **Password change** updates the password hash, but does not revoke: - existing DRF tokens stored in `authtoken_token` - existing JWT refresh tokens (no server-side revocation list or token versioning); refresh can continue minting new access tokens until refresh expiry. #### Vulnerable Files - `wger/wger/core/views/user.py` (logout implementation) - `wger/settings/settings_global.py` (DRF auth configuration, SimpleJWT defaults) - `wger/settings/main.py` (commonly used production defaults for JWT lifetimes) - `wger/wger/utils/api_token.py` (authtoken rotation is manual only) ### PoC (Proof of Concept) #### Manual Exploitation Steps 1. Create a user account. 2. Obtain a JWT refresh token: - `POST /api/v2/token` with username/password. 3. Obtain a DRF token (API key): - use `/user/api-key` (or create token via admin/DB in a test environment). 4. Change passwor",
    "evidence": "osv:PYSEC-2026-4315",
    "products": [
      {
        "name": {
          "value": "wger",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.1.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.2",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.2rc1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.3",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.4",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.5",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.6",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.6.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.7",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.8",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.9",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.1",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "PYSEC-2026-4315",
      "aliases": [
        "CVE-2026-46437",
        "GHSA-v3x9-6gg8-c2c9",
        "PYSEC-2026-4315"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "2.1"
                }
              ]
            }
          ],
          "package": {
            "name": "wger",
            "purl": "pkg:pypi/wger",
            "ecosystem": "PyPI"
          },
          "versions": [
            "1.1",
            "1.1.1",
            "1.2",
            "1.2rc1",
            "1.3",
            "1.4",
            "1.5",
            "1.6",
            "1.6.1",
            "1.7",
            "1.8",
            "1.9",
            "2.0",
            "2.1"
          ],
          "database_specific": {
            "source": "https://github.com/pypa/advisory-database/blob/main/vulns/wger/PYSEC-2026-4315.yaml"
          }
        }
      ],
      "modified": "2026-10-15T14:45:10.352529218Z",
      "provider": "osv",
      "references": [
        "https://github.com/wger-project/wger/security/advisories/GHSA-v3x9-6gg8-c2c9",
        "https://github.com/wger-project/wger",
        "https://github.com/wger-project/wger/releases/tag/2.6",
        "https://pypi.org/project/wger",
        "https://github.com/advisories/GHSA-v3x9-6gg8-c2c9",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-46437"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2026-46437",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 332649,
  "published_at": "2026-10-15T10:22:47.005398+00:00"
}