CVE-2026-24894
📋 TL;DR
This vulnerability in FrankenPHP worker mode allows session data from one user's request to be accessible to another user's request processed by the same worker. This affects all FrankenPHP deployments running in worker mode with session handling. The issue occurs before session_start() is called, potentially exposing sensitive session data.
💻 Affected Systems
- FrankenPHP
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full session hijack where an attacker gains access to authenticated user sessions, potentially leading to account takeover, data theft, or privilege escalation.
Likely Case
Information disclosure where users can see fragments of other users' session data, potentially exposing personal information or application state.
If Mitigated
Limited exposure if sessions contain minimal sensitive data or if additional session validation is implemented.
🎯 Exploit Status
Exploitation requires understanding of FrankenPHP worker scheduling and session handling. No public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.11.2
Vendor Advisory: https://github.com/php/frankenphp/security/advisories/GHSA-r3xh-3r3w-47gp
Restart Required: No
Instructions:
Update FrankenPHP to version 1.11.2 or later using your package manager
For manual installation: download from https://github.com/php/frankenphp/releases/tag/v1.11.2
Replace existing FrankenPHP binary with patched version
No application restart required - workers will pick up new binary on next request
🔧 Temporary Workarounds
Disable Worker Mode
allRun FrankenPHP in traditional mode instead of worker mode to avoid the vulnerability
Modify FrankenPHP configuration to use traditional mode instead of worker mode
Session Isolation
allImplement application-level session validation to ensure session data belongs to current user
Add session validation logic in application code before using $_SESSION
🧯 If You Can't Patch
- Implement strict session validation in application code before accessing $_SESSION
- Consider migrating to traditional mode instead of worker mode
🔍 How to Verify
Check if Vulnerable:
Check FrankenPHP version and confirm if running in worker mode with session handlingCheck Version:
frankenphp --versionVerify Fix Applied:
Verify FrankenPHP version is 1.11.2 or higher and test session isolation between requests📡 Detection & Monitoring
Log Indicators:
- Multiple users reporting seeing other users' data
- Session-related errors or anomalies in application logs
Network Indicators:
- Unusual session activity patterns
- Multiple session creations from same worker
SIEM Query:
Search for application errors containing 'session' or '$_SESSION' anomalies across multiple user IDs