CVE-2026-24894
Published: 12 February 2026
Summary
CVE-2026-24894 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Php Frankenphp. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SC-4 (Information in Shared System Resources).
Deeper analysis
CVE-2026-24894 is a session management vulnerability affecting FrankenPHP, a modern application server for PHP. In versions prior to 1.11.2, when running in worker mode, the $_SESSION superglobal is not correctly reset between requests. This flaw enables a subsequent request processed by the same worker to access the $_SESSION data from the previous request—potentially belonging to a different user—prior to the invocation of session_start(). The vulnerability is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-269 (Improper Privilege Management), CWE-384 (Session Fixation), and CWE-613 (Insufficient Session Expiration).
The vulnerability can be exploited remotely by unauthenticated attackers over the network with low complexity and no user interaction required. An attacker can send crafted requests that are handled sequentially by the same FrankenPHP worker process, allowing them to read sensitive session data from prior requests. This results in high-impact confidentiality violations, such as leaking user-specific session information like authentication tokens or personal data stored in sessions.
Mitigation is available through upgrading to FrankenPHP version 1.11.2 or later, where the issue is fixed. The official GitHub security advisory (GHSA-r3xh-3r3w-47gp), release notes for v1.11.2, and the fixing commit (24d6c991a7761b638190eb081deae258143e9735) provide detailed patch information and verification steps for affected deployments.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6698
Vulnerability details
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to access the $_SESSION…
more
data of the previous request (potentially belonging to a different user) before session_start() is called. This vulnerability is fixed in 1.11.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated exploitation of public-facing FrankenPHP server (T1190) directly enables unauthorized access to prior users' session data/tokens before reset, facilitating web session cookie theft and hijacking (T1539).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Remediating the specific flaw in FrankenPHP's worker mode that fails to reset the $_SESSION superglobal between requests directly prevents session data leakage to subsequent users.
Prevents unauthorized information transfer via shared system resources like the process memory holding the unreset $_SESSION superglobal across sequential requests in the same worker.
Process isolation ensures separate execution domains per request, eliminating shared session state in worker processes that enables cross-user data access.