Session Fixation Vulnerability in Serendipity Weblog Engine

CVE-2026-39963

What is CVE-2026-39963?

The vulnerability exists in the Serendipity Weblog Engine, specifically in the serendipity_setCookie() function located in include/functions_config.inc.php. In versions 2.6-beta2 and earlier, this function improperly utilizes $_SERVER['HTTP_HOST'] as the domain for the setcookie() function without sufficient validation. This oversight allows an attacker to manipulate the Host header during the login process, exploiting scenarios such as MITM attacks, misconfigured reverse proxies, or malicious load balancers. Such exploitation results in the risk of authentication cookies being scoped to a domain under the attacker's control, potentially leading to session fixation, leakage of sensitive tokens, and privilege escalation if an admin logs in through a compromised Host header. The vulnerability was addressed in version 2.6.0.

References