Description

wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect() without validating it with url_has_allowed_host_and_scheme(). An attacker who delivers a crafted link to an authenticated trainer can redirect the trainer's browser to an attacker-controlled domain, enabling phishing and leaking the wger URL structure (including the impersonated user's user_pk) via the Referer header.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-06T12:17:16.567Z",
  "pubdate": "2026-09-06T12:17:16.567Z",
  "executiveSummary": "The wger application, specifically in versions prior to 2.6, contains an open redirect vulnerability located within the trainer_login view. This flaw arises from the improper handling of user-supplied input provided via the 'next' GET parameter.\nBy failing to sanitize or validate redirect targets using security-focused utilities like url_has_allowed_host_and_scheme(), the application permits an attacker to facilitate unauthorized redirection of authenticated trainer sessions to arbitrary, attacker-controlled domains.\nThe primary risk associated with this vulnerability is the potential for phishing attacks directed at authenticated users. Furthermore, successful exploitation enables the leakage of sensitive internal URL structures, including specific user identifiers (user_pk), which are inadvertently transmitted via the Referer header to the malicious destination.\nThis vulnerability requires an authenticated session and necessitates social engineering to induce a trainer to click a crafted malicious link. Once the trainer follows the link, the application executes the redirect without verifying the destination's legitimacy, posing a significant risk to the integrity of user authentication sessions and potentially exposing internal application metadata to external entities.",
  "technicalDetails": "The root cause of this vulnerability is a failure to perform input validation on the 'next' parameter within the trainer_login view, defined in wger/core/views/user.py. In versions 2.5.0 and earlier, the application utilizes HttpResponseRedirect() to process the 'next' GET parameter directly as provided by the user request.\nThe application lacks the necessary integration of Django's url_has_allowed_host_and_scheme() function, which is designed to ensure that redirect targets remain within a permitted set of domains. Consequently, the application will honor any URI or URL passed to the parameter, including absolute URLs pointing to external domains.\nThe attack flow begins when an attacker crafts a malicious URL pointing to the vulnerable trainer_login endpoint, appending a crafted 'next' parameter that contains an external, attacker-controlled domain. The attacker then lures an authenticated trainer into clicking this link.\nUpon the trainer's interaction with the link, the application processes the request. Because the trainer is already authenticated, the impersonation mode is activated, and the vulnerable view logic immediately redirects the user's browser to the URI specified in the 'next' parameter.\nThe impact of this redirection is twofold. First, it enables sophisticated phishing campaigns where a trainer is sent to a spoofed interface designed to capture further credentials or session information. Second, due to the structure of the redirect, the browser may include the current page's URL in the Referer header of the subsequent request to the malicious server.\nSince the trainer_login view handles sensitive user impersonation contexts, the leaked URL often contains the 'user_pk' of the user currently being impersonated. An attacker monitoring the destination domain can ingest this Referer information to map the internal user structure of the target wger deployment.\nThis vulnerability is strictly exploitable by an unauthenticated attacker, provided they can successfully socially engineer an authenticated trainer. The exposure is limited to the web interface and requires no specific privilege levels beyond the ability to influence the browser's navigation through crafted links."
}