CVE-2026-39963
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Serendipity versions 2.6-beta2 and below have a serendipity_setCookie() function in include/functions_config.inc.php that uses $_SERVER['HTTP_HOST'] without validation as the domain parameter of setcookie(). An attacker who can influence the Host header at login time (e.g., via MITM, reverse proxy misconfiguration, or load balancer manipulation) can force authentication cookies, including session and auto-login tokens, to be scoped to an attacker-controlled domain.
Risk Assessment
This enables session fixation, token leakage to attacker-controlled infrastructure, and privilege escalation if an admin logs in under a poisoned Host header. The risk affects session confidentiality and system integrity.
Recommendation
Update Serendipity to version 2.6.0 or later. Additionally, verify reverse proxy and load balancer configuration for proper Host header forwarding.
Other vulnerabilities in Serendipity
See all- CVE-2017-8101High
There is a CSRF vulnerability in Serendipity version 2.0.5 that allows attackers to install any themes via a GET request.
- CVE-2017-5609High
SQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows remote authenticated users to execute arbitrary SQL commands via the cat parameter.
- CVE-2017-5476High
Serendipity version 2.0.5 allows CSRF attacks that enable the installation of an event plugin or a sidebar plugin.
- CVE-2016-9752High
In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redirection) HTTP status code.
- CVE-2026-73629High
Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address formats to request internal services and retrieve response bodies through the public uploads directory.
- CVE-2026-73628Medium
Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/functions_routing.inc.php serveSearch(), the sanitisation pipeline runs urldecode() after HTML-encoding, so a single URL-encoded HTML payload survives strip_tags() and htmlspecialchars() and is then decoded back into live HTML in the page. A crafted search link can execute arbitrary JavaScript in the victim's browser. Fixed in 2.6.1.
- CVE-2026-67350Medium
Serendipity before version 2.6.1 contains an open redirect vulnerability in exit.php. Unauthenticated attackers can redirect users to arbitrary external sites by supplying a malicious Base64-encoded url parameter when the Track Exits plugin is configured with commentredirection set to s9y.
- CVE-2026-67351High
Serendipity before version 2.6.1 has an authentication context confusion vulnerability where password validation and session loading operate independently. An authenticated Editor can create a username collision with an Administrator account and obtain administrative privileges by logging in with their own password while the session loads the Administrator's account data.
- CVE-2024-58282High
Serendipity 2.5.0 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the media upload functionality. Attackers can exploit the file upload mechanism by creating a PHP shell with a command execution form that enables arbitrary system command execution on the web server.
Original NVD description (English source)
Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipity_setCookie() function in include/functions_config.inc.php uses $_SERVER['HTTP_HOST'] without validation as the domain parameter of setcookie(). An attacker who can influence the Host header at login time, such as via MITM, reverse proxy misconfiguration, or load balancer manipulation, can force authentication cookies including session tokens and auto-login tokens to be scoped to an attacker-controlled domain. This enables session fixation, token leakage to attacker-controlled infrastructure, and privilege escalation if an admin logs in under a poisoned Host header. This issue has been fixed in version 2.6.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS