CVE-2026-67350: Serendipity Open Redirect Vulnerability

CVE-2026-67350 Overview

CVE-2026-67350 is an open redirect vulnerability in Serendipity, an open-source PHP-based weblog system, affecting versions before 2.6.1. The flaw resides in exit.php and allows unauthenticated attackers to redirect users to arbitrary external sites. Exploitation requires the Track Exits plugin to be configured with commentredirection set to s9y. Attackers craft a malicious Base64-encoded url parameter that the application decodes and uses as the redirect target [CWE-601]. Because the redirect originates from the legitimate blog domain, the resulting URL appears trusted and can defeat basic URL reputation checks.

Critical Impact
Unauthenticated attackers can leverage a trusted blog domain to redirect visitors to attacker-controlled sites, enabling phishing, malware delivery, and reputation-filter bypass.

Affected Products

Serendipity versions prior to 2.6.1
Serendipity installations with the Track Exits plugin enabled
Serendipity configurations where commentredirection is set to s9y

Discovery Timeline

2026-07-31 - CVE-2026-67350 published to NVD
2026-08-01 - Last updated in NVD database

Technical Details for CVE-2026-67350

Vulnerability Analysis

Serendipity ships a Track Exits plugin that logs outbound clicks from readers. When commentredirection is set to s9y, the plugin routes navigation through exit.php. This handler accepts a url query parameter, Base64-decodes it, and issues an HTTP redirect to the decoded value without validating the destination against an allowlist of trusted hosts.

The vulnerability is categorized as an open redirect [CWE-601]. It does not compromise the server or the underlying database, but it does allow attackers to weaponize the blog's own domain. Since the resulting link resolves through the legitimate site, corporate URL filters, email gateways, and end users tend to treat it as safe. This trust transfer is the core issue that patch 2.6.1 addresses by constraining redirect targets.

Root Cause

The root cause is missing destination validation in exit.php. The handler decodes the attacker-supplied Base64 url parameter and forwards the browser to that location. There is no check that the decoded host matches the blog's own domain or an approved external list.

Attack Vector

An attacker Base64-encodes a malicious URL such as an attacker-controlled phishing page. They then distribute a link of the form https://victim-blog.example/exit.php?url=<base64> through email, social media, or advertising. When a victim clicks the link, Serendipity decodes the parameter and issues an HTTP redirect to the attacker's domain. The victim's browser follows the redirect and lands on the malicious site while still associating the interaction with the trusted blog. See the GitHub Security Advisory and the VulnCheck Advisory on Serendipity for full technical details.

Detection Methods for CVE-2026-67350

Indicators of Compromise

Web server access log entries showing requests to /exit.php?url= with Base64-encoded values
HTTP 302 responses from exit.php with Location headers pointing to external, non-affiliated domains
Referrer logs on downstream systems indicating traffic originating from the Serendipity blog domain but arriving at unexpected destinations

Detection Strategies

Parse web access logs, Base64-decode the url parameter, and flag requests where the decoded host does not match the blog's own domain or an approved allowlist
Alert on unusually high volumes of exit.php requests from a single source, which may indicate reconnaissance or link-laundering
Correlate outbound redirects from exit.php with threat intelligence feeds to identify redirects to known phishing or malware infrastructure

Monitoring Recommendations

Enable verbose logging on the web server hosting Serendipity and retain full query strings for exit.php
Forward web logs to a centralized SIEM and build a decoded-URL enrichment step for the url parameter
Monitor secure email gateways and proxy logs for outbound clicks that traverse the Serendipity domain before reaching untrusted destinations

How to Mitigate CVE-2026-67350

Immediate Actions Required

Upgrade Serendipity to version 2.6.1 or later on all instances
If immediate patching is not possible, disable the Track Exits plugin or change commentredirection away from s9y
Review historical web logs for prior abuse of exit.php and notify affected users if suspicious redirects are found

Patch Information

The issue is resolved in Serendipity 2.6.1. Administrators should apply the upgrade through their standard update workflow and verify the version reported in the admin console. Refer to the GitHub Security Advisory GHSA-77rw-27c5-4hxm for release details.

Workarounds

Disable the Track Exits plugin in the Serendipity plugin manager until the upgrade is applied
Change the commentredirection setting to a value other than s9y to bypass the vulnerable code path
Add a web application firewall rule that blocks or rewrites requests to exit.php where the Base64-decoded url parameter targets an external domain

bash

# Example WAF rule (ModSecurity) to block external redirects via exit.php
SecRule REQUEST_URI "@beginsWith /exit.php" \
  "chain,phase:2,deny,status:403,id:1026067350,msg:'CVE-2026-67350 open redirect attempt'"
  SecRule ARGS:url "!@rx ^[A-Za-z0-9+/=]+$" "t:none"