CVE-2026-46437 wger-project CVE debrief

Who should care

Defenders responsible for the security of wger package deployments, particularly those using API credentials for authentication, should assess exposure and implement mitigations to prevent potential unauthorized access.

Why it matters

Defenders should prioritize verifying exposure of API credentials, revoking existing tokens, and implementing compensating controls to mitigate potential unauthorized access. This vulnerability allows an attacker with stolen credentials to maintain access even after the victim logs out or changes their password.

• Continued access to protected /api/v2/* endpoints using stolen credentials
• Potential unauthorized access to sensitive data or functionality
• Need for manual token rotation or deletion to revoke access
• Increased risk of lateral movement or privilege escalation

Technical summary

The vulnerability exists due to the lack of revocation of bearer-style API credentials, including DRF authtokens and JWT refresh tokens, during logout and password change events in the wger package. This allows an attacker with stolen credentials to maintain access to protected /api/v2/* endpoints even after the victim logs out or changes their password. Defenders should prioritize verifying exposure of API credentials, revoking existing tokens, and implementing compensating controls to mitigate potential unauthorized access. The affected product deployments should be identified, and owners assigned for follow-up. Official advisories and CVE records should be reviewed to validate affected scope, severity, and

Defensive priority

Defenders should prioritize verifying exposure of API credentials, revoking existing tokens, and implementing compensating controls to mitigate potential unauthorized access.

Recommended defensive actions

• Verify exposure of API credentials in use
• Revoke existing DRF authtokens and JWT refresh tokens
• Implement compensating controls to mitigate potential unauthorized access
• Monitor for suspicious activity on /api/v2/* endpoints
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is confirmed in versions 1.1 through 2.1 of the wger package on PyPI. The CVE Program and NVD records provide official details, while the source item and references offer additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.