CVE-2026-100502
mediumFlame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain to…
Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/pawelmalak/flame disclosure@vulncheck.com
- https://github.com/pawelmalak/flame/blob/v2.4.0/controllers/auth/login.js#L9-L17 disclosure@vulncheck.com
- https://github.com/pawelmalak/flame/blob/v2.4.0/utils/init/initSecret.js#L8-L25 disclosure@vulncheck.com
- https://github.com/pawelmalak/flame/blob/v2.4.0/utils/signToken.js#L4 disclosure@vulncheck.com
- https://github.com/pawelmalak/flame/issues/494 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/flame-through-2.4.0-admin-token-insufficient-session-... disclosure@vulncheck.com
- https://github.com/pawelmalak/flame/issues/494 134c704f-9b21-4f2e-91b3-4a467353bcc0