Serendipity before version 2.6.1 contains an open redirect flaw in the exit.php script. Attackers can supply a malicious Base64‑encoded url parameter when the Track Exits plugin is configured with commentredirection set to s9y, causing browsers to navigate to arbitrary external sites. This mechanism allows attackers to craft URLs that appear to come from the legitimate blog domain, facilitating phishing, malware delivery, or bypassing of URL reputation filters.

The vulnerability affects Serendipity (s9y) installations running any version older than 2.6.1 that have the Track Exits plugin enabled. All such versions are vulnerable; no finer version granularity is provided.

The CVSS score of 2.1 indicates a low severity level. The EPSS score is below 1 % and the flaw is not listed in the CISA KEV catalog, suggesting a low probability of widespread exploitation. Nonetheless, because the redirect can be made to look legitimate, it can still be leveraged in phishing or malware campaigns over the web interface without authentication.