THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-86256 (MEDIUM 5.4) — wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect() without val

[NVD] CVE-2026-86256 (MEDIUM 5.4) — wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect() without val

mednvdPublished 2026-09-06

CVE-2026-86256 CVSS: 5.4 MEDIUM Published: 2026-09-06T12:17:16.567

wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect() without validating it with url_has_allowed_host_and_scheme(). A

MITRE ATT&CK techniques

ImpersonationT1684.001
ImpersonationAML.T0073

Indicators of compromise

CVE-2026-86256cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-86256