Vulnerability Description
Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring both use the same user record. An authenticated Editor can create a username collision with an Administrator account and obtain administrative privileges by logging in with their own password while the session loads the Administrator's account data.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/s9y/Serendipity/security/advisories/GHSA-v645-243f-jwgh
- https://www.vulncheck.com/advisories/serendipity-authentication-bypass-via-usern
- https://github.com/s9y/Serendipity/security/advisories/GHSA-v645-243f-jwgh
FAQ
What is CVE-2026-67351?
CVE-2026-67351 is a vulnerability with a CVSS score of 8.8 (HIGH). Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring both use the same user record. ...
How severe is CVE-2026-67351?
CVE-2026-67351 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-67351?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.