CVE-2026-86256: URL Redirection to Untrusted Site ('Open Redirect') in wger-project wger

CVE-2026-86256 describes an open redirect vulnerability in wger before version 2.6 (affected versions are >=0 and <2.6). The vulnerability exists in the trainer_login view (wger/core/views/user.py), where after a trainer enters impersonation mode, the application redirects to a user-supplied 'next' GET parameter using HttpResponseRedirect() without validating the URL with url_has_allowed_host_and_scheme(). This lack of validation enables an attacker to craft links that redirect authenticated trainers to malicious external sites, potentially facilitating phishing and leaking sensitive URL information including the impersonated user's user_pk via the Referer header.

An attacker can exploit this vulnerability by delivering a crafted link to an authenticated trainer user, causing their browser to be redirected to an attacker-controlled domain. This can be used for phishing attacks and to leak internal URL structures through the Referer header. The vulnerability requires the user to be authenticated and to interact with a malicious link, and it does not allow direct code execution or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid clicking on untrusted links that may redirect after impersonation mode. Monitor vendor communications for updates regarding an official fix.