CVE-2026-67351
High · 8.8CVSS
8.8
EPSS
0.6%
Published
Jul 30, 2026
CISA due date
—
The record
Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring both use the same user record. An authenticated Editor can create a username collision with an Administrator account and obtain administrative privileges by logging in with their own password while the session loads the Administrator's account data.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-77800 ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML… CWE-304
- CVE-2023-54391 Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass… CWE-304
- CVE-2026-76207 phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where… CWE-304
- CVE-2026-49467 Pingvin Share X is a secure and easy self-hosted file sharing platform. CWE-304
- CVE-2026-61466 In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server… CWE-304
- CVE-2026-61143 Vulnerability in the Oracle Communications Convergent Charging Controller product of… CWE-304
- CVE-2026-55957 Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm… CWE-304
- CVE-2026-57915 It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending… CWE-304