CVE-2026-39963

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39963", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-08T00:01:47.626Z", "datePublished": "2026-04-14T23:31:13.843Z", "dateUpdated": "2026-04-15T13:23:48.591Z"}, "containers": {"cna": {"title": "Serendipity: Host Header Injection enables authentication cookie scoping to an attacker-controlled domain", "problemTypes": [{"descriptions": [{"cweId": "CWE-565", "lang": "en", "description": "CWE-565: Reliance on Cookies without Validation and Integrity Checking", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/s9y/Serendipity/security/advisories/GHSA-4m6c-649p-f6gf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/s9y/Serendipity/security/advisories/GHSA-4m6c-649p-f6gf"}, {"name": "https://github.com/s9y/Serendipity/releases/tag/2.6.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/s9y/Serendipity/releases/tag/2.6.0"}], "affected": [{"vendor": "s9y", "product": "Serendipity", "versions": [{"version": "< 2.6.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T23:31:13.843Z"}, "descriptions": [{"lang": "en", "value": "Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipity_setCookie() function in include/functions_config.inc.php uses $_SERVER['HTTP_HOST'] without validation as the domain parameter of setcookie(). An attacker who can influence the Host header at login time, such as via MITM, reverse proxy misconfiguration, or load balancer manipulation, can force authentication cookies including session tokens and auto-login tokens to be scoped to an attacker-controlled domain. This enables session fixation, token leakage to attacker-controlled infrastructure, and privilege escalation if an admin logs in under a poisoned Host header. This issue has been fixed in version 2.6.0."}], "source": {"advisory": "GHSA-4m6c-649p-f6gf", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/s9y/Serendipity/security/advisories/GHSA-4m6c-649p-f6gf", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T13:23:44.552367Z", "id": "CVE-2026-39963", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T13:23:48.591Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39963", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T13:23:44.552367Z"}}}], "references": [{"url": "https://github.com/s9y/Serendipity/security/advisories/GHSA-4m6c-649p-f6gf", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T13:23:40.363Z"}}], "cna": {"title": "Serendipity: Host Header Injection enables authentication cookie scoping to an attacker-controlled domain", "source": {"advisory": "GHSA-4m6c-649p-f6gf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "s9y", "product": "Serendipity", "versions": [{"status": "affected", "version": "< 2.6.0"}]}], "references": [{"url": "https://github.com/s9y/Serendipity/security/advisories/GHSA-4m6c-649p-f6gf", "name": "https://github.com/s9y/Serendipity/security/advisories/GHSA-4m6c-649p-f6gf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/s9y/Serendipity/releases/tag/2.6.0", "name": "https://github.com/s9y/Serendipity/releases/tag/2.6.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipity_setCookie() function in include/functions_config.inc.php uses $_SERVER['HTTP_HOST'] without validation as the domain parameter of setcookie(). An attacker who can influence the Host header at login time, such as via MITM, reverse proxy misconfiguration, or load balancer manipulation, can force authentication cookies including session tokens and auto-login tokens to be scoped to an attacker-controlled domain. This enables session fixation, token leakage to attacker-controlled infrastructure, and privilege escalation if an admin logs in under a poisoned Host header. This issue has been fixed in version 2.6.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-565", "description": "CWE-565: Reliance on Cookies without Validation and Integrity Checking"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T23:31:13.843Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39963", "state": "PUBLISHED", "dateUpdated": "2026-04-15T13:23:48.591Z", "dateReserved": "2026-04-08T00:01:47.626Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-14T23:31:13.843Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Serendipity", "vendor": "s9y", "versions": [{"status": "affected", "version": "< 2.6.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:s9y:serendipity:*:*:*:*:*:*:*:*", "matchCriteriaId": "25355E06-ECC8-4A6C-ADB1-1A8ED17E5ABF", "versionEndExcluding": "2.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:s9y:serendipity:2.6.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "D31C5F34-5B83-4955-870B-0D1AC375DA24", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipity_setCookie() function in include/functions_config.inc.php uses $_SERVER['HTTP_HOST'] without validation as the domain parameter of setcookie(). An attacker who can influence the Host header at login time, such as via MITM, reverse proxy misconfiguration, or load balancer manipulation, can force authentication cookies including session tokens and auto-login tokens to be scoped to an attacker-controlled domain. This enables session fixation, token leakage to attacker-controlled infrastructure, and privilege escalation if an admin logs in under a poisoned Host header. This issue has been fixed in version 2.6.0."}, {"lang": "es", "value": "Serendipity es un motor de weblogs impulsado por PHP. En las versiones 2.6-beta2 y anteriores, la funci\u00f3n serendipity_setCookie() en include/functions_config.inc.php utiliza $_SERVER[\u2019HTTP_HOST\u2019] sin validaci\u00f3n como par\u00e1metro de dominio de setcookie(). Un atacante que puede influir en el encabezado Host en el momento del inicio de sesi\u00f3n, como a trav\u00e9s de MitM, una mala configuraci\u00f3n de proxy inverso o manipulaci\u00f3n del balanceador de carga, puede forzar que las cookies de autenticaci\u00f3n, incluidos los tokens de sesi\u00f3n y los tokens de inicio de sesi\u00f3n autom\u00e1tico, se limiten a un dominio controlado por el atacante. Esto permite la fijaci\u00f3n de sesi\u00f3n, la fuga de tokens a infraestructura controlada por el atacante y la escalada de privilegios si un administrador inicia sesi\u00f3n bajo un encabezado Host envenenado. Este problema ha sido solucionado en la versi\u00f3n 2.6.0."}], "id": "CVE-2026-39963", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39963", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-15T13:23:44.552367Z", "version": "2.0.3"}}]}, "published": "2026-04-15T04:17:39.580", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/s9y/Serendipity/releases/tag/2.6.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/s9y/Serendipity/security/advisories/GHSA-4m6c-649p-f6gf"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/s9y/Serendipity/security/advisories/GHSA-4m6c-649p-f6gf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-565"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.6.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Serendipity", "source": "cna", "vendor": "s9y"}, "product": "serendipity", "vendor": "s9y"}], "analysis": {"en": {"generated_at": "2026-04-15T01:21:52.120754+00:00", "value": {"mitigation_remediation": ["Upgrade Serendipity to version 2.6.0 or later to remove the unchecked use of HTTP_HOST.", "Configure reverse proxies or load balancers to reject or sanitize Host header values so that untrusted domains cannot reach the application.", "Implement server\u2011side validation or hard\u2011code the cookie domain to prevent reliance on the HTTP_HOST header."], "summary": {"action": "Patch", "impact": "Privilege escalation via session cookie scoping"}, "threat_synthesis": {"affected_systems": "Vendors: Serendipity by s9y. Affected releases are versions 2.6\u2011beta2 and earlier. The flaw is fixed in version 2.6.0, released on GitHub. Upgrading to 2.6.0 or later eliminates the vulnerability.", "description_and_impact": "Serendipity, a PHP\u2011powered weblog engine, contains a flaw in the serendipity_setCookie() function that uses the raw HTTP_HOST header as the domain when setting cookies. Because the header is not validated, an attacker who can influence the Host header at login can force authentication cookies, including session and auto\u2011login tokens, to be scoped to an attacker\u2011controlled domain. This enables session fixation, token leakage and, for privileged users, elevation of privilege.", "risk_and_exploitability": "With a CVSS base score of 6.9, the vulnerability delivers a moderate level of risk. The documented exploit scenario requires the attacker to control the Host header, which can be achieved via TLS interception, misconfigured reverse proxies, or load\u2011balancer manipulation. No EPSS data is available, and the vulnerability is not listed in CISA's KEV catalog, but the nature of the flaw allows for remote exploitation and privilege escalation when an administrator logs in with a poisoned header. The attack vector is inferred from the description; an attacker must be able to influence HTTP requests served by the application."}}}}, "created": "2026-04-15T13:48:23.611490+00:00", "updated": "2026-04-15T14:28:41.083550+00:00", "vendors": ["s9y", "s9y$PRODUCT$serendipity"]}