wger CVE-2026-45161

Exploitation requires an active, authenticated trainer session in wger and that the trainer be socially engineered into loading an attacker-controlled page containing an <img> (or similar subresource) pointing at GET /en/user/<user_pk>/trainer-login. A critical technical precondition is defeating the browser's default SameSite=Lax cookie policy: the advisory shows this is achieved via the view's ?next= handling, where a 302 to /user/login?next=... produces a same-origin redirect hop that reattaches the session cookie. Limiting factors that reduce realistic risk: the victim must hold trainer privileges, user interaction (visiting the page) is mandatory, and the attack depends on the specific redirect-chain bypass rather than a direct cross-origin request - these constraints mean exploitation is targeted, not opportunistic or wormable. Fixed by upgrading to wger 2.6, which adds @require_POST and validates the redirect target.

This is a genuine but moderate-severity CSRF flaw (CWE-352) whose real-world risk is tempered by several limiting factors. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) correctly reflects network reach but requires user interaction (a trainer loading a malicious page) and a privileged victim session, keeping impact at Low/Low. No EPSS score was supplied and the CVE is NOT on CISA KEV, so there is no confirmed active exploitation. The advisory contains a Playwright-verified SameSite-Lax bypass description but does not publish a reusable exploit repository, so this is best characterized as 'no public exploit identified' rather than POC-available - the detailed bypass writeup does, however, lower the barrier for an attacker to reproduce it. One notable caveat: the CVSS AC:L understates the real difficulty, since modern browsers default to SameSite=Lax and the attack depends on a specific ?next= same-origin redirect chain to attach the cookie - verify the AC rating against the documented bypass. Net: a legitimate issue worth patching for any wger instance with trainer accounts, but not a drop-everything priority given no KEV, no published POC, the UI:R requirement, and the niche deployment footprint.

An attacker hosts a web page containing <img src="https://wger.target/en/user/2/trainer-login">. When an authenticated wger trainer is lured into visiting that page, their browser auto-issues the GET with the session cookie (chained through a ?next= same-origin redirect to defeat SameSite=Lax), and the server silently rebinds the trainer's session to user account 2. No public exploit package exists, though the advisory documents the technique in enough detail to reproduce.