{"id":"CVE-2026-45161","revision":"66a5b6e70dd84dada3fcdfd349e85553","records":[{"revision":"66a5b6e70dd84dada3fcdfd349e85553","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-45161","aliases":[],"title":"wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding","description":"wger is a free, open-source workout and fitness manager. Prior to version 2.6, the `trainer_login` view in wger accepts GET requests and executes `django_login()` without any CSRF protection, because Django's `CsrfViewMiddleware` only enforces tokens on unsafe methods (POST/PUT/PATCH/DELETE). An attacker can embed a single `<img>` tag on a malicious page; when an authenticated trainer loads that page, their browser auto-issues the GET with the session cookie, forcibly rebinding the trainer's session to an arbitrary user account. Version 2.6 fixes the issue.","state":0,"publishedAt":"2026-10-07T13:35:53.363+00:00","modifiedAt":"2026-10-07T17:04:45.845+00:00","affected":[{"ecosystem":"Vendor product","name":"wger","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"wger-project\",\n                    \"product\": \"wger\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.6\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4,"severity":"MEDIUM"}],"references":["https://github.com/wger-project/wger/security/advisories/GHSA-xf64-4pmc-h8qf","https://github.com/wger-project/wger/releases/tag/2.6"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-45161","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-45161","identifiers":["CVE-2026-45161"]},"retained":false,"historicalAffected":[]}],"coverage":[]}