Vulnerability Description
Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/pawelmalak/flame
- https://github.com/pawelmalak/flame/blob/v2.4.0/controllers/auth/login.js#L9-L17
- https://github.com/pawelmalak/flame/blob/v2.4.0/utils/init/initSecret.js#L8-L25
- https://github.com/pawelmalak/flame/blob/v2.4.0/utils/signToken.js#L4
- https://github.com/pawelmalak/flame/issues/494
- https://www.vulncheck.com/advisories/flame-through-2.4.0-admin-token-insufficien
- https://github.com/pawelmalak/flame/issues/494
FAQ
What is CVE-2026-100502?
CVE-2026-100502 is a vulnerability with a CVSS score of 5.0 (MEDIUM). Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplyin...
How severe is CVE-2026-100502?
CVE-2026-100502 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-100502?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.