CVE-2026-24894

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-24894
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to access the $_SESSION data of the previous request (potentially belonging to a different user) before session_start() is called. This vulnerability is fixed in 1.11.2.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/php/frankenphp/commit/24d6c991a7761b638190eb081deae258143e9735 Patch
https://github.com/php/frankenphp/releases/tag/v1.11.2 Release Notes
https://github.com/php/frankenphp/security/advisories/GHSA-r3xh-3r3w-47gp Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*
History

20 Feb 2026, 18:31

Type Values Removed Values Added
CPE cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References () https://github.com/php/frankenphp/commit/24d6c991a7761b638190eb081deae258143e9735 - () https://github.com/php/frankenphp/commit/24d6c991a7761b638190eb081deae258143e9735 - Patch
References () https://github.com/php/frankenphp/releases/tag/v1.11.2 - () https://github.com/php/frankenphp/releases/tag/v1.11.2 - Release Notes
References () https://github.com/php/frankenphp/security/advisories/GHSA-r3xh-3r3w-47gp - () https://github.com/php/frankenphp/security/advisories/GHSA-r3xh-3r3w-47gp - Exploit, Vendor Advisory
Summary
  • (es) FrankenPHP es un moderno servidor de aplicaciones para PHP. Antes de la versión 1.11.2, al ejecutar FrankenPHP en modo worker, la superglobal $_SESSION no se restablece correctamente entre solicitudes. Esto permite que una solicitud subsiguiente procesada por el mismo worker acceda a los datos de $_SESSION de la solicitud anterior (potencialmente perteneciente a un usuario diferente) antes de que se llame a session_start(). Esta vulnerabilidad se corrige en la versión 1.11.2.
First Time Php
Php frankenphp

12 Feb 2026, 20:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-12 20:16

Updated : 2026-02-20 18:31

NVD link : CVE-2026-24894

Mitre link : CVE-2026-24894

CVE.ORG link : CVE-2026-24894

JSON object : View

Products Affected

php

  • frankenphp
CWE
CWE-269

Improper Privilege Management

CWE-384

Session Fixation

CWE-613

Insufficient Session Expiration