CVE-2026-24894
Published: 12 February 2026
Summary
CVE-2026-24894 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Php Frankenphp. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Automatically terminating sessions after a defined period directly enforces session expiration, preventing indefinite session lifetimes that attackers can exploit.
Re-authentication after inactivity or time-based triggers prevents indefinite use of potentially hijacked or stale sessions.
Policy addresses roles, responsibilities, and privilege management to prevent improper privilege assignments.
Locks the device (typically after inactivity) until re-authentication, addressing insufficient session expiration by preventing indefinite access.
Access supervision ensures privileges are assigned and managed without improper escalation or retention.
Assigning group/role memberships and access authorizations (privileges) while reviewing accounts addresses improper privilege management.
Enforces proper privilege management by requiring all decisions through the verified reference monitor.
By mandating division of duties across roles, the control enforces proper privilege management and prevents a single entity from controlling an entire sensitive process.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated exploitation of public-facing FrankenPHP server (T1190) directly enables unauthorized access to prior users' session data/tokens before reset, facilitating web session cookie theft and hijacking (T1539).
NVD Description
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to access the $_SESSION…
more
data of the previous request (potentially belonging to a different user) before session_start() is called. This vulnerability is fixed in 1.11.2.
Deeper analysisAI
CVE-2026-24894 is a session management vulnerability affecting FrankenPHP, a modern application server for PHP. In versions prior to 1.11.2, when running in worker mode, the $_SESSION superglobal is not correctly reset between requests. This flaw enables a subsequent request processed by the same worker to access the $_SESSION data from the previous request—potentially belonging to a different user—prior to the invocation of session_start(). The vulnerability is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-269 (Improper Privilege Management), CWE-384 (Session Fixation), and CWE-613 (Insufficient Session Expiration).
The vulnerability can be exploited remotely by unauthenticated attackers over the network with low complexity and no user interaction required. An attacker can send crafted requests that are handled sequentially by the same FrankenPHP worker process, allowing them to read sensitive session data from prior requests. This results in high-impact confidentiality violations, such as leaking user-specific session information like authentication tokens or personal data stored in sessions.
Mitigation is available through upgrading to FrankenPHP version 1.11.2 or later, where the issue is fixed. The official GitHub security advisory (GHSA-r3xh-3r3w-47gp), release notes for v1.11.2, and the fixing commit (24d6c991a7761b638190eb081deae258143e9735) provide detailed patch information and verification steps for affected deployments.
Details
- CWE(s)