The vulnerability stems from an open redirect in the trainer_login view of the wger application. After a trainer activates impersonation, the view issues an HttpResponseRedirect to the URL supplied by the user-supplied 'next' parameter without validating it against allowed host and scheme restrictions. The flaw is classified as CWE‑601 and allows an attacker to redirect an authenticated trainer’s browser to an arbitrary external domain, facilitating phishing attempts and leaking the wger URL structure—including the impersonated user’s primary key—via the Referer header.

Affected systems are the wger web service developed by wger‑project. All releases up to and including version 2.5.0 contain the issue; new releases starting at 2.6 have removed the vulnerable code path.

The CVSS score is 5.1, which denotes a medium severity impact. With the attack confined to authenticated trainer users and requiring a crafted link, the likelihood of exploitation is moderate, although the EPSS score is not currently available. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known widespread exploitation. An attacker can leverage the flaw by delivering a malicious link to a trainer, leading to unauthorized redirection and possible credential compromise or phishing.