Is CVE-2026-39963 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39963 being exploited in the wild.

How severe is CVE-2026-39963?

Medium severity, with a CVSS score of 6.9, published 15 April 2026.

Which products and versions are affected?

s9y/serendipity (Packagist) < 2.6.0, ECOSYSTEM:introduced=0,fixed=2.6.0; Serendipity < 2.6.0.

Is there a fix for CVE-2026-39963?

Yes. s9y/serendipity (Packagist): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39963 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-39963?

Check whether you run s9y/serendipity (Packagist), S9y Serendipity or Serendipity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39963: Serendipity Host Header Injection in serendipity_setCookie

Q: Is there a fix for CVE-2026-39963?

Yes. s9y/serendipity (Packagist): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-39963 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-39963?

Check whether you run s9y/serendipity (Packagist), S9y Serendipity or Serendipity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39963 · Severity: medium · CVSS 6.9 · Published 2026-04-15

Serendipity, a popular PHP-based weblog engine, is vulnerable to a security flaw where an attacker can manipulate the domain to which login cookies are sent. By tricking a user or exploiting network configurations, an attacker can cause the system to send sensitive session tokens to a domain they control. This could allow an attacker to hijack user sessions, including administrative accounts, potentially leading to full site takeover.

Technologies: S9y Serendipity, Serendipity. Vendors: Packagist, S9y, Serendipity.

Quick answers

Is CVE-2026-39963 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39963 being exploited in the wild.
How severe is CVE-2026-39963?: Medium severity, with a CVSS score of 6.9, published 15 April 2026.
Which products and versions are affected?: s9y/serendipity (Packagist) < 2.6.0, ECOSYSTEM:introduced=0,fixed=2.6.0; Serendipity < 2.6.0.
Is there a fix for CVE-2026-39963?: Yes. s9y/serendipity (Packagist): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39963 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-39963?: Check whether you run s9y/serendipity (Packagist), S9y Serendipity or Serendipity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

s9y/serendipity (Packagist): upgrade to 2.6.0 or later
```
composer require s9y/serendipity:^2.6.0
```

Technical details

The `serendipity_setCookie()` function in `include/functions_config.inc.php` uses the unvalidated `$_SERVER['HTTP_HOST']` variable to define the `domain` attribute for session and auto-login cookies. An attacker can perform Host Header Injection by providing a malicious `Host` header during a login request. If successful, the victim's browser will scope sensitive cookies (like `author_token` and `author_autologintoken`) to the attacker's domain. This facilitates session hijacking, session fixation, and credential leakage. The vulnerability is patched in version 2.6.0 by validating the host against the configured site URL.

Affected products

s9y Serendipity < 2.6.0

Identifiers

CVE-2026-39963
GHSA-4m6c-649p-f6gf

Timeline

2026-04-13: disclosed
2026-04-14: advisory: GitHub Advisory published
2026-04-15: patched: NVD publication and release of version 2.6.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.