CVE-2026-45161: wger Trainer Login CSRF Bypass Vulnerability
Summary
CVE-2026-45161: wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding. Affects wger versions < 2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
wger is an open-source gym management application that allows trainers to manage workout plans and track client progress. It provides features for user management, workout logging, and performance tracking. However, the application has a vulnerability in its trainer login functionality that allows attackers to exploit CSRF weaknesses, potentially compromising user accounts.
Vulnerability Detail
The vulnerability exists in the 'trainer_login' view of wger, which accepts GET requests and executes the 'django_login()' function without CSRF protection. This oversight allows an attacker to embed an image tag in a malicious page. When an authenticated trainer visits this page, their browser automatically sends a GET request with the session cookie, leading to session rebinding to an arbitrary user account. The lack of CSRF token validation on this endpoint creates a significant security risk, enabling unauthorized access to user accounts without the trainer's consent.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the trainer login functionality until the patch is applied. Educate users about the risks of clicking on unknown links or loading untrusted pages while logged into the application.
Conclusion
The CSRF bypass vulnerability in wger's trainer login functionality poses a significant risk to user accounts. It is crucial to apply the recommended patch and implement the suggested code changes to mitigate this risk. Users should remain vigilant against phishing attempts and suspicious links.
See every vulnerability recorded for wger →
FAQ
The vulnerability allows an attacker to exploit CSRF weaknesses in the trainer login functionality, enabling session rebinding to an arbitrary user account.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
An attacker can impersonate a trainer, gaining unauthorized access to user accounts and potentially compromising sensitive information.
Yes, updating to wger version 2.1 or later will address this vulnerability.
As a temporary measure, educate users to avoid clicking on suspicious links and consider disabling the trainer login functionality until the patch is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for wger.
