CVE-2026-46437: wger API Credentials Remain Valid After Logout and Password Change
Summary
CVE-2026-46437: wger: API credentials remain valid after logout/password change. Affects wger versions < 2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
wger is an open-source web application designed for managing workout routines and tracking fitness progress. It provides a RESTful API for developers to integrate with various applications. The application utilizes Django Rest Framework for authentication, which includes bearer-style API credentials such as DRF authtokens and JWT refresh tokens. This vulnerability affects the session lifecycle management of these credentials, allowing unauthorized access even after user logout or password changes.
Vulnerability Detail
A vulnerability exists in the authentication and session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. This means that if an attacker steals a victim's DRF authtoken or JWT refresh token, they can continue to access protected API endpoints until the token is manually rotated or expires naturally. The logout process only clears the Django session cookie without revoking API tokens, and changing the password does not affect existing tokens, leading to potential unauthorized access.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually rotate their API tokens after changing their password or logging out. This can be done by calling the appropriate endpoint to generate a new DRF token or JWT refresh token, ensuring that old tokens are no longer used.
Conclusion
The vulnerability CVE-2026-46437 in the wger application allows API credentials to remain valid after logout and password changes, posing a significant security risk. Users are encouraged to update to the latest version of the package to mitigate this issue and implement token rotation as a temporary workaround.
See every vulnerability recorded for wger →
FAQ
An attacker can retain access to a victim's private API data even after the victim has logged out or changed their password, compromising both confidentiality and integrity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package, ensure to manually rotate your API tokens after any password changes or logouts to mitigate the risk.
Yes, you can implement a token rotation mechanism in your application to automatically generate new tokens upon certain events, such as password changes.
The CVSS score of this vulnerability is 4.8, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for wger.
