CVE-2026-67351

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-67351

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67351.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-67351

Aliases

GHSA-v645-243f-jwgh

Published

2026-07-30T13:57:51.756Z

Modified

2026-08-02T03:32:11.751096018Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Serendipity < 2.6.1 Authentication Bypass via Username Collision

Details

Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring both use the same user record. An authenticated Editor can create a username collision with an Administrator account and obtain administrative privileges by logging in with their own password while the session loads the Administrator's account data.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67351.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-304"
    ]
}

References

Affected packages

Git / github.com/s9y/serendipity

Affected ranges

Type

GIT

Repo

https://github.com/s9y/serendipity

Events

Introduced

Fixed

9aa100a744977cd3d85e462fe5f190c866d7e8a0

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.6.1"
        }
    ]
}

Affected versions

2.*

2.1-beta1

2.1-beta2

2.1-beta3

2.1-rc1

2.1.0

2.1.1

2.2.1-alpha1

2.3-beta1

2.3-rc1

2.3.0

2.4-beta1

2.4.0

2.5-beta1

2.5.0

2.6-beta1

2.6.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67351.json"