# CVE-2026-82416: FrankenPHP cross-request session ID leak in worker mode

Source: https://junglewise.ai/threats/cve-2026-82416-frankenphp-cross-request-php-session-id-leak-in-worker-mode-when  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-15  
License: CC BY 4.0 with a link back

CVE-2026-82416 · Severity: high · CVSS 7.7 · Published 2026-10-13

FrankenPHP is an application server that runs PHP in worker threads. When the PHP session extension is loaded as a shared module (common in packaged distributions), a session ID from one user's request can leak to another concurrent user, or a user can receive a stale session from a previous request. An attacker could hijack another user's session or cause users to be intermittently logged out and served incorrect sessions.

Technologies: [github.com/dunglas/frankenphp (Go)](https://junglewise.ai/threats/technologies/github-com-dunglas-frankenphp). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-82416 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82416 being exploited in the wild.

**How severe is CVE-2026-82416?** High severity, with a CVSS score of 7.7, published 13 October 2026.

**Which products and versions are affected?** FrankenPHP all versions when compiled against PHP with session as a shared module; github.com/dunglas/frankenphp (Go) <= 1.12.4, SEMVER:introduced=0,fixed=1.12.5.

**Is there a fix for CVE-2026-82416?** Yes. github.com/dunglas/frankenphp (Go): upgrade to 1.12.5 or later. Until then: Use a FrankenPHP build compiled against PHP with the session extension statically linked (such as the official static binaries or Docker images). Alternatively, in the worker request loop after `session_write_close()`, explicitly call `session_id('')` so that the next `session_start()` re-reads the request cookie; enable `session.use_strict_mode=1` to enforce session validation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82416 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-82416?** Check whether you run FrankenPHP or github.com/dunglas/frankenphp (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/dunglas/frankenphp (Go): upgrade to 1.12.5 or later

  ```sh
  go get github.com/dunglas/frankenphp@v1.12.5
  ```


Use a FrankenPHP build compiled against PHP with the session extension statically linked (such as the official static binaries or Docker images). Alternatively, in the worker request loop after `session_write_close()`, explicitly call `session_id('')` so that the next `session_start()` re-reads the request cookie; enable `session.use_strict_mode=1` to enforce session validation.

## Technical details

The vulnerability is a request-state cleanup bug in the session extension's global state reset. FrankenPHP's session state reset function is guarded by `HAVE_PHP_SESSION`, a macro only defined when the session extension is statically linked at compile time. When the extension is loaded as a shared module, the reset is compiled out, leaving `PS(id)` stale across request boundaries. Subsequent `session_start()` calls skip reading the request cookie if `PS(id)` is non-NULL, reusing the previous request's session ID for whichever client is served next by the same worker thread. No authentication is required; any client can trigger this by sending session cookies concurrently.

## Affected products

- FrankenPHP FrankenPHP all versions when compiled against PHP with session as a shared module

## Identifiers

- CVE-2026-82416
- GHSA-v3ph-cgqh-r8p5
- GO-2026-6797

## Timeline

- 2026-10-15: disclosed

## Related threats

- [FrankenPHP remote code execution via unsafe Unicode handling in CGI path splitting](https://junglewise.ai/threats/cve-2026-45062-frankenphp-remote-code-execution-via-unsafe-unicode-handling-in)
- [GO-2026-4442 - FrankenPHP has delayed propagation of security fixes in upstream base images in github.com/dunglas/frankenphp](https://junglewise.ai/threats/go-2026-4442-frankenphp-has-delayed-propagation-of-security-fixes-in-2df5a458)
- [GO-2026-4486 - FrankenPHP's unicode case-folding length expansion causes incorrect split_path index…](https://junglewise.ai/threats/cve-2026-24895-frankenphp-s-unicode-case-folding-length-expansion-causes)
- [GO-2026-4489 - FrankenPHP leaks session data between requests in worker mode in github.com/dunglas/frankenphp](https://junglewise.ai/threats/cve-2026-24894-frankenphp-leaks-session-data-between-requests-in-worker-mode)
- [FrankenPHP has delayed propagation of security fixes in upstream base images](https://junglewise.ai/threats/frankenphp-has-delayed-propagation-of-security-fixes-in-upstream-base-d650c732)