CVE-2026-82416
Description
A flaw was found in FrankenPHP. When operating in worker mode with the session extension configured as a shared module, the application server fails to properly clear session state across request boundaries. Under concurrent traffic, a worker thread can reuse an existing session identifier rather than generating or reading the incoming user's session cookie. A remote attacker can exploit this issue to access another user's session, resulting in session hijacking and information disclosure.
Statement
This vulnerability is rated as Important because remote, unauthenticated attackers can hijack active user sessions and compromise confidential data across concurrent web requests. FrankenPHP is not distributed or supported within Red Hat Enterprise Linux or other Red Hat products, which instead utilize standard PHP runtimes such as PHP-FPM where request isolation is managed independently. Furthermore, the issue only manifests when operating in persistent worker mode against dynamic PHP session modules, leaving standard request-handling modes and static builds unaffected.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Data can "bleed" from one session to another through member variables of singleton objects, such as Servlets, and objects from a shared pool. Storing user data in Servlet member fields introduces a data access race condition.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
