CVE-2026-46437: wger: API credentials remain valid after logout/password change

A vulnerability exists in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken (Authorization: Token ...) or JWT refresh token can continue to access protected /api/v2/* endpoints until the token is manually rotated/deleted (DRF token) or naturally expires (JWT refresh). lifecycle events do not revoke these credentials:

• Logout (/user/logout) only clears the Django session cookie via django_logout() and does not revoke API tokens.
• Password change updates the password hash, but does not revoke:
• existing DRF tokens stored in authtoken_token
• existing JWT refresh tokens (no server-side revocation list or token versioning); refresh can continue minting new access tokens until refresh expiry.