CVE-2026-39963 s9y CVE debrief

Who should care

Defenders responsible for Serendipity installations, especially those with admin login functionality, should assess exposure and apply version 2.6.0 or later to address the vulnerability.

Why it matters

CVE-2026-39963 allows attackers to manipulate authentication cookies via the Host header, enabling session fixation and potential privilege escalation in Serendipity versions 2.6-beta2 and below. Defenders should verify exposure, especially for installations with admin login functionality, and apply version 2.6.0 or later. Evidence from official sources supports these impacts, but further verification is required to confirm exploitation or specific business impacts.

• Session fixation attacks via poisoned Host headers
• Potential leakage of authentication tokens to attacker-controlled infrastructure
• Privilege escalation if an admin logs in under a poisoned Host header
• Verification of Serendipity version and exposure to vulnerable functionality

Technical summary

The serendipity_setCookie() function in Serendipity versions 2.6-beta2 and below uses $_SERVER['HTTP_HOST'] without validation as the domain parameter of setcookie(). This allows attackers who can influence the Host header to force authentication cookies, including session tokens and auto-login tokens, to be scoped to an attacker-controlled domain. As a result, attackers can enable session fixation and potential privilege escalation in Serendipity versions 2.6-beta2 and below. Defenders should verify exposure, especially for installations with admin login functionality, and apply version 2.6.0 or later.

Defensive priority

Defenders should prioritize verifying exposure of Serendipity installations, especially those with admin login functionality, and apply version 2.6.0 or later.

Recommended defensive actions

• Verify Serendipity installations for exposure, especially those with admin login functionality
• Apply version 2.6.0 or later to address the vulnerability
• Monitor login attempts and session activity for potential exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Serendipity versions 2.6-beta2 and below, including the affected function and potential impacts. Evidence from official sources supports these impacts, but further verification is required to confirm exploitation or specific business impacts. Defenders should verify exposure, especially for installations with admin login functionality, and apply version 2.6.0 or later. The serendipity_setCookie() function's use of $_SERVER['HTTP_HOST'] without validation enables an

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.