What is CVE-2026-46437?

CVE-2026-46437 is a medium-severity vulnerability in Wger-Project Wger, classified under Improper Authentication. CVSS score: 4.8/10. Published 2026-10-07.

How severe is CVE-2026-46437?

Medium severity. CVSS v3 base score is 4.8 out of 10.

Auth bypass in Wger-Project Wger

CVE-2026-46437

wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of `wger` where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken (`Authorization: Token ...`) or JWT refresh token can continue to access protected `/api/v2/*` endpoints until the token is manually rotated/deleted (DRF token) or naturally expires (JWT refresh). Version 2.6 contains a patch.

Vulnerability class: Broken Authentication

Published 2026-10-07 · last modified 2026-10-07.

CVSS v3 metric

CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Wger-Project Wger — versions < 2.6

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-46437?: CVE-2026-46437 is a medium-severity vulnerability in Wger-Project Wger, classified under Improper Authentication. CVSS score: 4.8/10. Published 2026-10-07.
How severe is CVE-2026-46437?: Medium severity. CVSS v3 base score is 4.8 out of 10.