Open Redirect Affecting wger package, versions [0,]
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-WGER-16439044
- published7 May 2026
- disclosed6 May 2026
- creditwhatisproblem
Introduced: 6 May 2026
CVE NOT AVAILABLE CWE-601 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Overview
Affected versions of this package are vulnerable to Open Redirect via the trainer_login function. An attacker can redirect a user's browser to an external, attacker-controlled URL by supplying a crafted next parameter, potentially exposing sensitive information such as the original URL structure and session details through the Referer header. This can facilitate phishing attacks or credential harvesting if the victim interacts with the malicious destination.