Vulnerability Description
Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt counters, lockouts, or delays to gain full administrator access and modify application configuration.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/pawelmalak/flame
- https://github.com/pawelmalak/flame/blob/v2.4.0/.docker/Dockerfile#L28
- https://github.com/pawelmalak/flame/blob/v2.4.0/controllers/auth/login.js#L11-L2
- https://github.com/pawelmalak/flame/blob/v2.4.0/routes/auth.js#L7
- https://github.com/pawelmalak/flame/issues/494
- https://www.vulncheck.com/advisories/flame-through-2.4.0-brute-force-attack-via-
FAQ
What is CVE-2026-100501?
CVE-2026-100501 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the ad...
How severe is CVE-2026-100501?
CVE-2026-100501 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-100501?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.