FrankenPHP, a modern PHP application server, fails to reset the $_SESSION superglobal between consecutive HTTP requests when running in worker mode. Consequently, a request handled by the same worker can read session data written by a previous request before session_start() clears it, resulting in accidental disclosure of another user’s session contents. This flaw reflects improper session handling and can lead to unauthorized access to sensitive data. Based on the description, it is inferred that an attacker who can arrange for two users’ requests to be serviced by the same worker in sequence could read the prior user’s session data.

All deployments of php:frankenphp using worker mode and running any version older than 1.11.2 are vulnerable. The issue is fixed in release 1.11.2 and later. Deployments that employ persistent worker processes are affected; single‑request workers are safe.

The vulnerability carries a CVSS score of 8.7, indicating high severity for confidentiality loss. Its EPSS score is below 1 %, meaning exploitation is currently rare, and it is not listed in the CISA KEV catalog. The risk materializes when a worker can handle requests for two distinct users in succession, allowing an attacker to read another user’s session data before it is cleared. While the flaw does not permit arbitrary code execution, it can expose credentials and other sensitive information, potentially enabling privilege escalation or data breaches.