CVE-2026-39963 affects Serendipity weblog engine versions before 2.6.0. The vulnerability arises because serendipity_setCookie() uses the unvalidated $_SERVER['HTTP_HOST'] value as the domain parameter in setcookie(). An attacker capable of influencing the Host header (e.g., via MITM, reverse proxy misconfiguration, or load balancer manipulation) can cause authentication cookies, including session and auto-login tokens, to be scoped to a domain controlled by the attacker. This can lead to session fixation, leakage of authentication tokens to attacker infrastructure, and privilege escalation if an admin logs in with a poisoned Host header. The vulnerability is classified under CWE-565 (Reliance on Cookies without Validation and Integrity Checking).

Successful exploitation allows attackers to fix sessions, steal authentication tokens, and escalate privileges by manipulating cookie domains. This can compromise user sessions, including administrative accounts, leading to unauthorized access. The CVSS score is 6.9 (medium severity), reflecting network attack vector with high confidentiality impact but limited integrity and no availability impact.

Upgrade Serendipity to version 2.6.0 or later, where this vulnerability is fixed. Since the vendor advisory indicates the issue is resolved in 2.6.0, applying this official fix is the recommended remediation. Patch status is confirmed by the vendor's versioning information. No additional mitigation steps are specified.