CVE-2026-82416
Received Received - Intake

FrankenPHP Session State Retention in Worker Mode

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_session_state() is compiled out, PS(id) can survive a request boundary, and a subsequent session_start() can ignore the new request's cookie because an identifier is already present. Under concurrent requests, session_id() can therefore return another client's identifier or a stale identifier from a previous request on the same worker thread, causing cross-user session exposure, possible session hijacking, and intermittent logout behavior. Builds with the session extension statically linked, including the official static binaries and Docker images, are not affected. This issue is fixed in version 1.12.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-82416
EUVD
EUVD-2026-98911

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
php frankenphp < 1.12.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
CWE-488 The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FrankenPHP before 1.12.5 in worker mode can retain PHP session state between requests when the session extension is loaded as a shared module. This happens because frankenphp_reset_session_state() is not compiled, allowing PS(id) to persist across requests. A session_start() may ignore new cookies due to an existing session ID, leading to cross-user session exposure or hijacking under concurrent requests.

Detection Guidance

Check FrankenPHP version with 'frankenphp -v' or inspect Docker image tags. Monitor for session inconsistencies like unexpected user logins or session ID reuse across requests. Look for PHP session extension loaded as a shared module in 'php -m' output.

Impact Analysis

This vulnerability can expose sessions between different users, allowing attackers to hijack sessions or cause intermittent logout issues. It primarily affects builds where the session extension is shared and not statically linked, enabling cross-user data leakage during concurrent requests.

Compliance Impact

This vulnerability could lead to unauthorized access to user sessions, violating data confidentiality requirements under GDPR and HIPAA. It may result in data breaches, non-compliance with access controls, and failure to protect sensitive information, potentially leading to legal and regulatory penalties.

Mitigation Strategies

Upgrade FrankenPHP to version 1.12.5 or later. Ensure PHP session extension is statically linked. Restart all FrankenPHP workers to clear existing session states. Review session handling in applications for anomalies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82416. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart