CVE-2026-82416: FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVEPHPSESSION at compile time. In this build configuration, frankenphpresetsessionstate() is compiled out, PS(id) can survive a request boundary, and a subsequent sessionstart() can ignore the new request's cookie because an identifier is already present. Under concurrent requests, sessionid() can therefore return another client's identifier or a stale identifier from a previous request on the same worker thread, causing cross-user session exposure, possible session hijacking, and intermittent logout behavior. Builds with the session extension statically linked, including the official static binaries and Docker images, are not affected. This issue is fixed in version 1.12.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FrankenPHPto a version that resolves this vulnerability.Fixed in 1.12.5
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use FrankenPHP worker mode with the PHP session extension loaded as a shared module, where HAVE_PHP_SESSION was unavailable at compile time. Official static binaries and Docker images, which statically link the session extension, are not affected.
What does an attacker need to exploit this issue?
No privileges or user interaction are required, but exploitation depends on requests being handled under the affected worker-mode build configuration. Concurrent requests can cause a worker thread to retain a prior session identifier and use it instead of the new request's cookie.
What should we do if we cannot patch immediately?
Use a build with the session extension statically linked, such as the official static binaries or Docker images, rather than an affected shared-module build. Upgrading to FrankenPHP 1.12.5 fixes the issue.
How might this appear in an affected application?
Applications may show intermittent logout behavior or return another client's session identifier from session_id(). These symptoms can occur when a stale session ID survives from a previous request on the same worker thread.