CVE-2026-39963

{"id": "CVE-2026-39963", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39963", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T13:23:44.552367Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "s9y", "product": "Serendipity", "versions": [{"status": "affected", "version": "< 2.6.0"}]}]}], "published": "2026-04-15T04:17:39.580", "references": [{"url": "https://github.com/s9y/Serendipity/releases/tag/2.6.0", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/s9y/Serendipity/security/advisories/GHSA-4m6c-649p-f6gf", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/s9y/Serendipity/security/advisories/GHSA-4m6c-649p-f6gf", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-565"}]}], "descriptions": [{"lang": "en", "value": "Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipity_setCookie() function in include/functions_config.inc.php uses $_SERVER['HTTP_HOST'] without validation as the domain parameter of setcookie(). An attacker who can influence the Host header at login time, such as via MITM, reverse proxy misconfiguration, or load balancer manipulation, can force authentication cookies including session tokens and auto-login tokens to be scoped to an attacker-controlled domain. This enables session fixation, token leakage to attacker-controlled infrastructure, and privilege escalation if an admin logs in under a poisoned Host header. This issue has been fixed in version 2.6.0."}, {"lang": "es", "value": "Serendipity es un motor de weblogs impulsado por PHP. En las versiones 2.6-beta2 y anteriores, la funci\u00f3n serendipity_setCookie() en include/functions_config.inc.php utiliza $_SERVER[\u2019HTTP_HOST\u2019] sin validaci\u00f3n como par\u00e1metro de dominio de setcookie(). Un atacante que puede influir en el encabezado Host en el momento del inicio de sesi\u00f3n, como a trav\u00e9s de MitM, una mala configuraci\u00f3n de proxy inverso o manipulaci\u00f3n del balanceador de carga, puede forzar que las cookies de autenticaci\u00f3n, incluidos los tokens de sesi\u00f3n y los tokens de inicio de sesi\u00f3n autom\u00e1tico, se limiten a un dominio controlado por el atacante. Esto permite la fijaci\u00f3n de sesi\u00f3n, la fuga de tokens a infraestructura controlada por el atacante y la escalada de privilegios si un administrador inicia sesi\u00f3n bajo un encabezado Host envenenado. Este problema ha sido solucionado en la versi\u00f3n 2.6.0."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:s9y:serendipity:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25355E06-ECC8-4A6C-ADB1-1A8ED17E5ABF", "versionEndExcluding": "2.6.0"}, {"criteria": "cpe:2.3:a:s9y:serendipity:2.6.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D31C5F34-5B83-4955-870B-0D1AC375DA24"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}