CVE-2026-39963: Reliance on Cookies without Validation and Integrity Checking

Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipitysetCookie function in include/functionsconfig.inc.php uses $SERVER'HTTPHOST' without validation as the domain parameter of setcookie. An attacker who can influence the Host header at login time, such as vi...

EUVD-2026-22809

Serendipity has a Host Header Injection allows authentication cookie scoping to attacker-controlled domain in functionsconfig.inc.php...