Cross-user Session Exposure in FrankenPHP Application Server

CVE-2026-82416

What is CVE-2026-82416?

FrankenPHP is a modern application server designed for PHP applications. An issue exists prior to version 1.12.5 where the worker mode can inadvertently retain PHP session state across requests. This occurs when the session extension is loaded as a shared module, leading to possible cross-user session exposure. Specifically, when certain configurations are used, the identifier for current sessions may be retained on the same worker thread, resulting in the risk that session identifiers from previous requests could be used by other users. This could lead to session hijacking or unexpected logouts. The vulnerability is resolved in version 1.12.5, highlighting the importance of using up-to-date versions for securing web applications.

References