PT-2026-32966 · Unknown · Serendipity

Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-39963

Positive Technologies (AI Summary)

CVSS v3.1

6.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 2.6.0

Description The serendipity setCookie() function in include/functions config.inc.php uses the $ SERVER['HTTP HOST'] variable without validation as the domain parameter of the setcookie() function. An attacker who can influence the Host header during login—through methods such as man-in-the-middle (MITM) attacks, reverse proxy misconfigurations, or load balancer manipulation—can force authentication cookies, including session tokens and auto-login tokens, to be scoped to a domain controlled by the attacker. This can lead to session fixation, token leakage to attacker-controlled infrastructure, and privilege escalation if an administrator logs in while the Host header is poisoned.

Recommendations Update to version 2.6.0. As a temporary workaround, restrict access to the serendipity setCookie() function or ensure the Host header is strictly validated at the server or load balancer level to prevent header manipulation.

Exploit

Fix

Weakness Enumeration

CWE-565

Related Identifiers

CVE-2026-39963

GHSA-4M6C-649P-F6GF

Affected Products

Serendipity

References · 6

• 🔥 https://github.com/s9y/Serendipity/security/advisories/GHSA-4m6c-649p-f6gf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-39963 · Security Note
• https://osv.dev/vulnerability/GHSA-4m6c-649p-f6gf · Vendor Advisory
• https://github.com/s9y/Serendipity/releases/tag/2.6.0 · Note
• https://github.com/s9y/Serendipity · Note
• https://twitter.com/CVEnew/status/2044338866380034318 · Twitter Post