CVE-2024-26318: Serenity

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.

Affected products

• Serenity Serenity: before 6.8.0 (fixed in 6.8.0)

Published 2024-02-19. Last modified 2026-06-17.