The wger application has an open redirect vulnerability in the trainer_login view where the ?next= parameter is not validated against allowed hosts before redirecting. This allows an attacker to craft a URL that redirects a trainer user to an arbitrary external site after impersonation mode is activated. The redirect leaks the original wger URL via the Referer header and can facilitate phishing or credential harvesting. The issue affects wger versions prior to 2.6 and has a medium severity CVSS score of 5.4.