CVE-2026-39963 affects Serendipity weblog engine versions before 2.6.0. The serendipity_setCookie() function uses the unvalidated $_SERVER['HTTP_HOST'] value as the domain parameter in setcookie(). An attacker capable of influencing the Host header during login (e.g., via MITM, reverse proxy misconfiguration, or load balancer manipulation) can cause authentication cookies, including session and auto-login tokens, to be scoped to a domain controlled by the attacker. This leads to session fixation, leakage of tokens to attacker infrastructure, and possible privilege escalation if an admin authenticates under the poisoned Host header. The vulnerability is tracked as CWE-565 (Reliance on Cookies without Validation and Integrity Checking). The issue is resolved in Serendipity version 2.6.0.

Exploitation allows attackers to fix sessions or leak authentication tokens by manipulating the Host header, potentially leading to unauthorized access and privilege escalation, especially if an administrator logs in under the attacker-controlled domain. The CVSS score of 6.9 (medium severity) reflects the network attack vector, high confidentiality impact, limited integrity impact, and no availability impact.

Upgrade Serendipity to version 2.6.0 or later, where this vulnerability has been fixed. Patch status is not explicitly stated beyond the fix in version 2.6.0, so users should verify they are running this or a newer version. No vendor advisory was provided to indicate alternative mitigations or temporary fixes.