FrankenPHP, a modern PHP application server, can maintain PHP session state across request boundaries when the session extension is loaded as a shared module and the binary is built without HAVE_PHP_SESSION. Because frankenphp_reset_session_state() is omitted in this configuration, session identifiers can persist, allowing a subsequent session_start() to honor an old or another client's cookie. This behavior results in the session_id() function returning a stale or unrelated identifier under concurrent requests. The consequence is cross‑user session exposure, potential session hijacking, and unpredictable logout behavior.

The vulnerability affects FrankenPHP versions prior to 1.12.5 running in worker mode with the session extension configured as a shared module. Builds that include the session extension statically, such as the official static binaries and Docker images provided by the developers, are not impacted. Users deploying older worker–mode builds should verify their configuration and consider replacing them with a binary that includes the fix.

With a CVSS score of 7.7 and no EPSS data, the vulnerability represents a moderate‑to‑high risk, and it is not yet listed in the CISA KEV catalog. The likely attack vector is web traffic delivered to the server, and an attacker who can generate concurrent requests to a shared worker thread could capture a valid PHP session identifier from another client. The session fixation condition arises only when the session extension is a shared module, so the exploit requires that configuration. Once a stale ID is obtained, it can be used to impersonate the victim session. There is no requirement for local access or privileged code execution, but the impact on confidentiality and availability is significant for sessions that carry authenticated state.