Serendipity, a PHP‑powered weblog engine, contains a flaw in the serendipity_setCookie() function that uses the raw HTTP_HOST header as the domain when setting cookies. Because the header is not validated, an attacker who can influence the Host header at login can force authentication cookies, including session and auto‑login tokens, to be scoped to an attacker‑controlled domain. This enables session fixation, token leakage and, for privileged users, elevation of privilege.

Vendors: Serendipity by s9y. Affected releases are versions 2.6‑beta2 and earlier. The flaw is fixed in version 2.6.0, released on GitHub. Upgrading to 2.6.0 or later eliminates the vulnerability.

With a CVSS base score of 6.9, the vulnerability delivers a moderate level of risk. The documented exploit scenario requires the attacker to control the Host header, which can be achieved via TLS interception, misconfigured reverse proxies, or load‑balancer manipulation. No EPSS data is available, and the vulnerability is not listed in CISA's KEV catalog, but the nature of the flaw allows for remote exploitation and privilege escalation when an administrator logs in with a poisoned header. The attack vector is inferred from the description; an attacker must be able to influence HTTP requests served by the application.