wger EUVD-2026-94334

Exploitation requires the attacker to already possess a valid stolen bearer credential - either a DRF authtoken sent as 'Authorization: Token ...' or a SimpleJWT refresh token obtained from POST /api/v2/token; the vulnerability itself provides no means to acquire that token. The defining condition is that lifecycle events fail to revoke credentials: /user/logout only clears the Django session cookie and password change only updates the hash, leaving rows in authtoken_token valid and JWT refresh tokens usable (no server-side revocation list or token versioning). LIMITING FACTORS: no token theft, no exploit; DRF tokens persist until manually rotated/deleted and JWT refresh tokens until natural expiry, so impact window depends on configured REFRESH_TOKEN_LIFETIME; only affects wger versions prior to 2.6.

This is a moderate, defense-in-depth authentication weakness (CWE-287) rather than a high-urgency flaw. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, base 4.8 Medium) correctly reflects that the vulnerability is network-reachable but gated behind high attack complexity, because exploitation is impossible without first obtaining the victim's bearer credential through some out-of-band means. The PR:N label is technically accurate (the attacker does not authenticate with their own account) but is misleading in isolation - the real precondition is possession of a stolen DRF authtoken or JWT refresh token, so this is effectively a post-compromise persistence/privilege-retention issue, not a primary access vector. No EPSS score, no SSVC decision data, and no CISA KEV listing are present in the input, so automatable/exploitation-maturity signals cannot be compared; absence of EPSS/KEV is not evidence of safety but does suggest this is not a mass-exploited target. A detailed, runnable proof-of-concept is published in the GHSA advisory, so publicly available exploit code exists - but POC availability must not be conflated with active exploitation, which is not indicated by any source here. Net: real but low-to-medium priority for internet-facing self-hosted instances, driven mainly by the fact that logout and password change - the exact actions a user takes after suspecting compromise - fail to revoke access.

An attacker who has already captured a user's API token (e.g., via leaked browser/local storage, an XSS, or intercepted traffic) continues calling /api/v2/* endpoints even after the victim notices the compromise and logs out and changes their password. Because neither action revokes the DRF authtoken or JWT refresh token, the stolen credential keeps working - and the JWT refresh token can mint fresh access tokens until it naturally expires. A copy-paste Python PoC demonstrating token replay after password change is published in the vendor's GHSA advisory.