CVE-2026-46437: CWE-287: Improper Authentication in wger-project wger

wger, an open-source workout and fitness manager, has an improper authentication vulnerability (CWE-287) affecting versions before 2.6. The issue lies in the session lifecycle management where bearer tokens such as DRF authtokens and JWT refresh tokens remain valid even after a user logs out or changes their password. This flaw allows continued access to protected API endpoints (/api/v2/*) by an attacker who has stolen these tokens. The vulnerability is patched in version 2.6.

An attacker who steals a valid DRF authtoken or JWT refresh token can maintain unauthorized access to protected API endpoints until the token is manually revoked or naturally expires. This can lead to unauthorized information disclosure and limited integrity impact. The CVSS 3.1 base score is 4.8 (medium severity), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality and integrity impact.

Upgrade wger to version 2.6 or later, which contains a patch that properly invalidates bearer tokens upon user logout and password changes. Until upgrading, manually rotate or delete DRF authtokens and monitor token usage to reduce risk.