CVE-2026-82416

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_session_state() is compiled out, PS(id) can survive a request boundary, and a subsequent session_start() can ignore the new request's cookie because an identifier is already present. Under concurrent requests, session_id() can therefore return another client's identifier or a stale identifier from a previous request on the same worker thread, causing cross-user session exposure, possible session hijacking, and intermittent logout behavior. Builds with the session extension statically linked, including the official static binaries and Docker images, are not affected. This issue is fixed in version 1.12.5.

• CWE-362
• CWE-488

• https://github.com/php/frankenphp/commit/be24d82531675f90862b8cde1e9fc7e9ee855aa5
• https://github.com/php/frankenphp/pull/2523
• https://github.com/php/frankenphp/releases/tag/caddy/v1.12.5
• https://github.com/php/frankenphp/security/advisories/GHSA-v3ph-cgqh-r8p5

Published

Oct 13, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82409Klever-Go is the Go implementation of the Klever blockchain …8.4
• CVE-2026-8241A vulnerability has been found in Industrial Application Sof…5.5
• CVE-2026-82410Pocketbase is an open source web backend written in go. Prio…8.7
• CVE-2026-82411Open Object provides an API and admin interface to manage ob…6.5
• CVE-2026-82412ntopng is a web-based network traffic monitoring application…8.8
• CVE-2026-82413ntopng is a web-based network traffic monitoring application…8.8
• CVE-2026-82417### Summary `qs.stringify` throws a `TypeError` when it s…5.3
• CVE-2026-82418IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 cou…9.8
• CVE-2026-8242A vulnerability was found in Industrial Application Software…3.7
• CVE-2026-82421A vulnerability was identified in itsourcecode Sales and Inv…6.3
• CVE-2026-82422A security flaw has been discovered in itsourcecode Sales an…6.3
• CVE-2026-82423A vulnerability has been found in macrozheng mall up to 1.0.…5.4