CVE-2026-67350 is an open redirect vulnerability affecting Serendipity versions before 2.6.1. The issue exists in exit.php and is triggered when the Track Exits plugin is configured with commentredirection set to s9y. Attackers can supply a malicious Base64-encoded url parameter to redirect users to arbitrary external sites without authentication. This can be abused to create trusted-looking URLs leveraging the legitimate blog domain, which may be used for phishing, malware distribution, or bypassing URL reputation filters. The CVSS 4.0 score is 2.1, reflecting low severity. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

The vulnerability allows unauthenticated attackers to redirect users to arbitrary external websites via a crafted URL. This can facilitate phishing attacks, malware delivery, or evasion of URL reputation systems by leveraging the trusted domain of the affected Serendipity blog. The impact is limited to user redirection and does not include direct compromise of the application or data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or reconfiguring the Track Exits plugin to avoid using the commentredirection set to s9y option. Additionally, educating users to be cautious of unexpected redirects from the blog domain can help mitigate risk.