CVE-2026-67350: Serendipity < 2.6.1 Open Redirect via exit.php
Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to redirect users to arbitrary external sites by supplying a malicious Base64-encoded url parameter when the Track Exits plugin is configured with commentredirection set to s9y. Attackers can craft trusted-looking URLs leveraging the legitimate blog domain to conduct phishing, deliver malware, or bypass URL reputation filters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Serendipityto a version that resolves this vulnerability.Fixed in 2.6.1 - Configuration
If using the Track Exits plugin, change commentredirection from "s9y" to a non-"s9y" value to avoid the open redirect in exit.php (vulnerable when commentredirection is set to s9y before 2.6.1).
Serendipity (Track Exits plugin) commentredirection = s9y - Compensating control
As a mitigation while patching, block or restrict requests to exit.php and prevent external redirects from the blog domain at the web server/reverse proxy or via network controls.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67350?
The severity of CVE-2026-67350 is medium with a score of 4.3.
How do I fix CVE-2026-67350?
To fix CVE-2026-67350, upgrade to Serendipity version 2.6.1 or later.
What type of vulnerability is CVE-2026-67350?
CVE-2026-67350 is an open redirect vulnerability.
Can CVE-2026-67350 be exploited by unauthenticated attackers?
Yes, CVE-2026-67350 can be exploited by unauthenticated attackers.
What allows the exploitation of CVE-2026-67350?
The exploitation of CVE-2026-67350 is possible by supplying a malicious Base64-encoded url parameter.