SCA: security update for s9y/serendipity (GHSA-4m6c-649p-f6gf)

medium Tenable Self-Hosted Container Security Plugin ID 440401

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipity_setCookie()
function in include/functions_config.inc.php uses $_SERVER['HTTP_HOST'] without validation as the domain
parameter of setcookie(). An attacker who can influence the Host header at login time, such as via MITM,
reverse proxy misconfiguration, or load balancer manipulation, can force authentication cookies including
session tokens and auto-login tokens to be scoped to an attacker-controlled domain. This enables session
fixation, token leakage to attacker-controlled infrastructure, and privilege escalation if an admin logs
in under a poisoned Host header. This issue has been fixed in version 2.6.0. (CVE-2026-39963)

Solution

Update the s9y/serendipity library and its related packages to version 2.6.0 or later.

Plugin Details

Severity: Medium

ID: 440401

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 4/15/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.9

Percentile: 52.77

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:P/A:N

CVSS Score Source: CVE-2026-39963

CVSS v3

Risk Factor: Medium

Base Score: 6.9

Temporal Score: 6.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/14/2026

Vulnerability Publication Date: 4/14/2026

Reference Information

CVE: CVE-2026-39963

cwe: CWE-565

Detections

Analytics