CVE-2026-24894: php frankenphp Improper Privilege Management

Vulnerability summary

CVE-2026-24894 is a high (CVSS 8.7) Improper Privilege Management vulnerability in php frankenphp. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 12-02-2026
   PublishedVulnerability first disclosed.
2. 12-02-2026
   Last modifiedVulnerability information updated.

Description

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to access the $_SESSION data of the previous request (potentially belonging to a different user) before session_start() is called. This vulnerability is fixed in 1.11.2.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
• CWE-384Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
• CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."