Executive brief
Serendipity, a popular PHP-based weblog engine, is vulnerable to a security flaw where an attacker can manipulate the domain to which login cookies are sent. By tricking a user or exploiting network configurations, an attacker can cause the system to send sensitive session tokens to a domain they control. This could allow an attacker to hijack user sessions, including administrative accounts, potentially leading to full site takeover.
Technical details
The `serendipity_setCookie()` function in `include/functions_config.inc.php` uses the unvalidated `$_SERVER['HTTP_HOST']` variable to define the `domain` attribute for session and auto-login cookies. An attacker can perform Host Header Injection by providing a malicious `Host` header during a login request. If successful, the victim's browser will scope sensitive cookies (like `author_token` and `author_autologintoken`) to the attacker's domain. This facilitates session hijacking, session fixation, and credential leakage. The vulnerability is patched in version 2.6.0 by validating the host against the configured site URL.
Affected products
- s9y Serendipity < 2.6.0
Timeline
- 2026-04-13: disclosed
- 2026-04-14: advisory: GitHub Advisory published
- 2026-04-15: patched: NVD publication and release of version 2.6.0