CVE-2026-67350 s9y CVE debrief

Who should care

Users of Serendipity versions prior to 2.6.1 who have the Track Exits plugin configured should review and update their installations. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess the potential impact of this vulnerability on their systems and take appropriate action.

Technical summary

The Serendipity blog software contains an open redirect vulnerability in the exit.php file when the Track Exits plugin is configured with comment redirection set to s9y. This allows unauthenticated attackers to redirect users to arbitrary external sites by supplying a malicious Base64-encoded URL parameter. The vulnerability has a CVSS score of 2.1 and is considered low severity. The vulnerability can be exploited by crafting trusted-looking URLs leveraging the legitimate blog domain to conduct phishing, deliver malware, or bypass URL reputation filters. Defenders should verify the open redirect vulnerability in Serendipity exit.php with Track Exits plugin configured and assess the potential impact on their systems.

Defensive priority

Low-priority defensive review recommended due to limited attack surface; verify affected versions and configurations.

Recommended defensive actions

• Verify Serendipity version and configuration
• Review Track Exits plugin settings
• Monitor for suspicious redirect activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The evidence for this CVE is limited. The vulnerability exists in the exit.php file of Serendipity when the Track Exits plugin is configured with comment redirection set to s9y. Defenders should verify the open redirect vulnerability in Serendipity exit.php with Track Exits plugin configured and assess the potential impact on their systems.

Official resources