CVE-2026-39963

{
  "id": "CVE-2026-39963",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-15T04:17:39.580",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2  and below, the serendipity_setCookie() function in include/functions_config.inc.php uses $_SERVER['HTTP_HOST'] without validation as the domain parameter of setcookie(). An attacker who can influence the Host header at login time, such as via MITM, reverse proxy misconfiguration, or load balancer manipulation, can force authentication cookies including session tokens and auto-login tokens to be scoped to an attacker-controlled domain. This enables session fixation, token leakage to attacker-controlled infrastructure, and privilege escalation if an admin logs in under a poisoned Host header. This issue has been fixed in version 2.6.0."
    },
    {
      "lang": "es",
      "value": "Serendipity es un motor de weblogs impulsado por PHP. En las versiones 2.6-beta2 y anteriores, la función serendipity_setCookie() en include/functions_config.inc.php utiliza $_SERVER[’HTTP_HOST’] sin validación como parámetro de dominio de setcookie(). Un atacante que puede influir en el encabezado Host en el momento del inicio de sesión, como a través de MitM, una mala configuración de proxy inverso o manipulación del balanceador de carga, puede forzar que las cookies de autenticación, incluidos los tokens de sesión y los tokens de inicio de sesión automático, se limiten a un dominio controlado por el atacante. Esto permite la fijación de sesión, la fuga de tokens a infraestructura controlada por el atacante y la escalada de privilegios si un administrador inicia sesión bajo un encabezado Host envenenado. Este problema ha sido solucionado en la versión 2.6.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "s9y",
          "product": "Serendipity",
          "versions": [
            {
              "version": "< 2.6.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-15T13:23:44.552367Z",
          "id": "CVE-2026-39963",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-565"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:s9y:serendipity:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.6.0",
              "matchCriteriaId": "25355E06-ECC8-4A6C-ADB1-1A8ED17E5ABF"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:s9y:serendipity:2.6.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "D31C5F34-5B83-4955-870B-0D1AC375DA24"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/s9y/Serendipity/releases/tag/2.6.0",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://github.com/s9y/Serendipity/security/advisories/GHSA-4m6c-649p-f6gf",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/s9y/Serendipity/security/advisories/GHSA-4m6c-649p-f6gf",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}