PHP CVE-2026-39963

CVSS 6.9 (AV:N/AC:H/PR:N/UI:R/S:C) with changed scope reflects moderate-to-high impact but higher attack complexity and user interaction requirement. Exploitation probability (EPSS 6.9) aligns with the CVSS assessment. The AC:H (high complexity) factor reflects the need for attacker control over the HTTP Host header, which requires MITM, reverse proxy misconfiguration, or load balancer compromise-realistic but not trivial in properly configured environments. UI:R (user interaction required) mandates that the victim must authenticate during the attack window, further reducing real-world exploitation likelihood in automated attack scenarios. However, the S:C (scope changed) and high confidentiality impact (C:H) indicate that successful exploitation compromises authentication boundaries and grants access to privileged accounts (admin tokens), making this a real priority for Serendipity deployments in untrusted networks or behind misconfigured reverse proxies. The existence of proof-of-concept code elevates practical risk slightly. Overall assessment: medium-priority vulnerability requiring patching in production environments, especially those accepting requests from untrusted upstream proxies or operating in shared hosting/CDN scenarios where Host header control is easier.

An attacker positioned as a man-in-the-middle (or controlling a misconfigured reverse proxy) intercepts a Serendipity administrator's login request and injects Host: attacker.com into the HTTP headers. The serendipity_setCookie() function uses this poisoned Host header to set the author_token cookie with domain=attacker.com instead of the legitimate domain. When the administrator's browser sends subsequent requests to attacker.com, it automatically includes the stolen authentication token, granting the attacker authenticated access to the Serendipity admin panel. A proof-of-concept curl command demonstrates the vulnerability by triggering cookie domain poisoning via a POST to serendipity_admin.php with a crafted Host header.