There's more to this than just the store. You're correct that ASP.NET Core does not support State Server (at least out of the box), so you will likely need to move to something like SQL Server or Redis, regardless.
However, the bigger issue is encryption/decryption. ASP.NET and ASP.NET Core employ entirely different methods of cryptography. ASP.NET uses a "machine key", where as ASP.NET Core use data protection providers and a key ring. Even assuming a shared session store, unless you get them speaking in the same language here, you won't be able to decrypt what was set by one from the other.
In that regard, though, you might be out of luck. ASP.NET MVC 5 supports OWIN and the data protection infrastructure in ASP.NET Core is OWIN compatible, so if you set up your ASP.NET app to utilize data protection providers and you share the same session store, key ring store, and application name, then they can view each other's cookies. However, I don't think Web Forms participates in this, even if you embed them in an MVC 5 app. As such, there's probably no way to share the session store between the two. Still, you can give it a go, I suppose. The worst that can happen is that it won't work, and you're right back where you are now. The ASP.NET Core docs cover how to set everything up.
