Description

A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset_user_password of the file wger/gym/views/gym.py of the component Password Reset. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. This patch is called 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314. It is advisable to implement a patch to correct this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-30T14:17:02.627Z",
  "pubdate": "2026-08-30T14:17:02.627Z",
  "executiveSummary": "A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the wger-project wger application, specifically within the password reset functionality. The flaw resides in the reset_user_password function located in wger/gym/views/gym.py. This vulnerability allows an unauthenticated remote attacker to force an authenticated user to unknowingly perform unwanted actions, such as resetting their account credentials, by executing a forged HTTP request.\nThe impact of this vulnerability is significant, as it can lead to full account takeover if an attacker successfully tricks a victim into visiting a malicious site or link while the victim has an active session. The issue affects all versions of wger up to 2.6.0-alpha2. Given that CSRF bypasses the user's intended actions, it poses a severe risk to account integrity and data confidentiality. There are no specific complex exploitation requirements, as the attack relies on the victim's existing authenticated state within their browser. Remediation is mandatory to ensure the security of user sessions.",
  "technicalDetails": "The vulnerability is located in the reset_user_password function within the file wger/gym/views/gym.py, which serves as the entry point for the password reset mechanism of the gym component. The root cause of this flaw is the absence of adequate cross-site request forgery protection (e.g., anti-CSRF tokens) or incorrect validation of state-changing requests, allowing the application to process unauthorized requests initiated by third-party sites.\nIn a typical attack scenario, a remote attacker crafts a malicious web page or a malicious link containing a hidden HTTP request targeting the reset_user_password endpoint. Because web browsers automatically include ambient credentials, such as session cookies, with requests sent to the associated domain, the server processes the request as if it were legitimately initiated by the logged-in user. If the endpoint does not verify the origin of the request or enforce a unique, cryptographically strong synchronizer token, the server will execute the password reset process.\nThe attack flow proceeds as follows: First, the attacker identifies the URL structure and parameters required to trigger the password reset function in the target wger installation. Second, the attacker embeds this request into a malicious site or email. Third, when an authenticated victim navigates to the attacker-controlled resource, the victim's browser sends the forged request to the wger instance. Finally, the server processes the request, potentially overwriting the victim's password or triggering a reset flow that grants the attacker unauthorized access. This exposure is critical because the attack is remote, does not require the attacker to possess the user's current password, and operates under the premise that the user has an active session cookie.\nThe vulnerability affects all versions of wger-project wger up to 2.6.0-alpha2. The lack of strict SameSite cookie attribute usage or mandatory CSRF token validation renders the password reset endpoint susceptible to state-changing manipulation by external domains. Post-exploitation impact includes the loss of account control and the potential compromise of sensitive personal or fitness data stored within the wger environment."
}