CVE-2026-24894 — FrankenPHP leaks session data between requests in worker mode
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset between requests. Th…
Published: 2026-02-12 · CVSS: 8.7 · CVSS 4.0
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to access the $_SESSION data of the previous request (potentially belonging to a different user) before session_start() is called. This vulnerability is fixed in 1.11.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7