The vulnerability in wger causes bearer‑style API credentials to remain valid after a user logs out or changes their password, allowing an attacker who obtains a DRF authtoken or JWT refresh token to continue accessing protected API endpoints until those tokens are manually rotated or naturally expire. This flaw represents an authentication and authorization weakness that can enable unauthorized data access or manipulation, with the potential to compromise the integrity and confidentiality of user data.

The issue affects the free, open‑source workout and fitness manager wger from the wger‑project, specifically all versions prior to 2.6. Version 2.6 and later include a fix that revokes or invalidates tokens when a user logs out or changes their password.

With a CVSS score of 4.8, the severity is medium. The EPSS score is unavailable and the vulnerability is not listed in CISA KEV, indicating it is not actively exploited at scale. The attack vector requires the attacker to obtain a valid API token, either through phishing, credential dumping, or other means. Once in possession of the token, exploitation is straightforward and does not require additional privileges or system access. The lack of an automated revocation mechanism is the root cause of the risk, making token rotation or invalidation a direct mitigation.