Flame through 2.4.0 Admin Token Insufficient Session Expiration
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-613.
Summary
Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pawelmalak | flame | up to 2.4.0 | — | No fix listed | CNA |
- flame Vendorpawelmalak Affected up to 2.4.0 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-100502
- 2026-10-03 Alias added: GHSA-h3fx-87pr-c7fx
References
More pawelmalak vulnerabilities
- TI-2026-64667 Flame through 2.4.0 Information Exposure via GET /api/config CVSS 4.0MEDIUM 6.9
- TI-2026-64669 Flame through 2.4.0 Brute-Force Attack via Login Endpoint CVSS 4.0HIGH 8.3
Sources
- CVE-2026-100502 · CVE Program
- CVE-2026-100502 · NVD
- FIRST EPSS
- GHSA-h3fx-87pr-c7fx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences