CVE-2026-46437: wger API Credentials Remain Valid After Logout and Password Change
Summary
CVE-2026-46437: wger: API credentials remain valid after logout/password change. Affects wger versions < 2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
wger is an open-source web application designed for managing workout routines and tracking fitness progress. It provides a RESTful API for users to interact with their data programmatically. The application utilizes Django Rest Framework (DRF) for authentication, allowing users to generate API tokens for secure access. However, a critical vulnerability exists in its session management, where API credentials do not get revoked upon user logout or password changes.
Vulnerability Detail
The vulnerability arises from the failure to invalidate bearer-style API credentials, such as DRF authtokens and JWT refresh tokens, after a user logs out or changes their password. This oversight allows an attacker who has intercepted these tokens to maintain access to protected API endpoints until the tokens are manually rotated or expire naturally. The logout process only clears the session cookie, and changing the password does not revoke existing tokens, leading to potential unauthorized access to sensitive user data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should manually rotate their API tokens after changing their password or logging out. This can be done by accessing the '/user/api-key' endpoint to generate a new DRF token and ensuring that old tokens are deleted from the database.
Conclusion
The vulnerability CVE-2026-46437 in the wger application highlights a critical flaw in its authentication mechanism, allowing API credentials to remain valid even after logout or password changes. Users are encouraged to update to the latest version and implement token rotation as a workaround to secure their accounts.
See every vulnerability recorded for wger →
FAQ
An attacker can retain access to a user's API data even after the user has taken steps to secure their account, such as logging out or changing their password.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, manually rotate your API tokens after any password change or logout to mitigate the risk.
The vulnerability affects both DRF authtokens and JWT refresh tokens used for API authentication.
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for wger.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
