https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T02:30:13.969814+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-384227 EUVD-2026-384227 2026-10-10T02:30:13.972072+00:00 EUVD-2026-384227 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45161 fkie_cve-2026-45161 2026-10-10T02:30:13.972103+00:00

wger is a free, open-source workout and fitness manager. Prior to version 2.6, the `trainer_login` view in wger accepts GET requests and executes `django_login()` without any CSRF protection, because Django's `CsrfViewMiddleware` only enforces tokens on unsafe methods (POST/PUT/PATCH/DELETE). An attacker can embed a single `<img>` tag on a malicious page; when an authenticated trainer loads that page, their browser auto-issues the GET with the session cookie, forcibly rebinding the trainer's session to an arbitrary user account. Version 2.6 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-xf64-4pmc-h8qf GHSA-xf64-4pmc-h8qf — wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding 2026-10-10T02:30:13.972137+00:00

Affected: PyPI: wger

### Summary

The `trainer_login` view in wger accepts GET requests and executes `django_login()` without any CSRF protection, because Django's `CsrfViewMiddleware` only enforces tokens on unsafe methods (POST/PUT/PATCH/DELETE). An attacker can embed a single `<img>` tag on a malicious page; when an authenticated trainer loads that page, their browser auto-issues the GET with the session cookie, forcibly rebinding the trainer's session to an arbitrary user account.

### Details

**File**: `wger/core/views/user.py`, approximately lines 161-210

```python # VULNERABLE - no @require_POST, no request.method == 'POST' guard # CsrfViewMiddleware is bypassed because CSRF enforcement only applies to # unsafe HTTP methods (POST, PUT, PATCH, DELETE) def trainer_login(request, user_pk): ... django_login(request, user, backend='django.contrib.auth.backends.ModelBackend') return HttpResponseRedirect(...) ```

Because the view handles GET, Django's CSRF middleware does not validate any token. An attacker can place `<img src="https://wger.target/en/user/2/trainer-login">` on any web page. When an authenticated trainer's browser loads that page, it issues the GET request with the session cookie attached (SameSite=Lax does not block same-site top-level navigation and subresource hops triggered by same-origin redirects). The server executes `django_login()` and issues a new session cookie binding the trainer to the victim user.

Playwright-verified in Chromium 147: the SameSite byp…