Threats Tagged 'ghsa-v3ph-cgqh-r8p5'

CVE-2026-82416 is a race condition vulnerability in FrankenPHP when running in worker mode with PHP's session extension loaded as a shared module rather than statically linked. This causes session IDs to leak between concurrent requests, leading to cross-user session exposure and session hijacking. The issue arises because session state reset code is compiled out when the session extension is shared, allowing stale session IDs to persist across requests. Builds with the session extension statically linked are not affected. The vulnerability results in users being intermittently logged out or served sessions belonging to other users.