CVE-2026-67351

HIGH 8.8

Serendipity < 2.6.1 Authentication Bypass via Username Collision

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring both use the same user record. An authenticated Editor can create a username collision with an Administrator account and obtain administrative privileges by logging in with their own password while the session loads the Administrator's account data.

CWE	CWE-304
Vendor	s9y
Product	serendipity
Published	Jul 30, 2026

Stay Ahead of the Next One

Get instant alerts for s9y serendipity

Be the first to know when new high vulnerabilities affecting s9y serendipity are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

s9y / Serendipity

0 < 2.6.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/s9y/Serendipity/security/advisories/GHSA-v645-243f-jwgh vulncheck.com: https://www.vulncheck.com/advisories/serendipity-authentication-bypass-via-username-collision

Credits

Vaibhav Kubade (@DevVaibhav07)