CVE-2026-100502

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.

CVSS v3 5.0 MEDIUM

5.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.7 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/pawelmalak/flame
https://github.com/pawelmalak/flame/blob/v2.4.0/controllers/auth/login.js#L9-L17
https://github.com/pawelmalak/flame/blob/v2.4.0/utils/init/initSecret.js#L8-L25
https://github.com/pawelmalak/flame/blob/v2.4.0/utils/signToken.js#L4
https://github.com/pawelmalak/flame/issues/494
https://www.vulncheck.com/advisories/flame-through-2.4.0-admin-token-insufficient-session-expiration
https://github.com/pawelmalak/flame/issues/494

Configurations

No configuration.

History

30 Sep 2026, 01:16

Type	Values Removed	Values Added
References	~~() https://github.com/pawelmalak/flame/issues/494 -~~	() https://github.com/pawelmalak/flame/issues/494 -

25 Sep 2026, 22:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-25 22:17

Updated : 2026-09-30 16:39

NVD link : CVE-2026-100502

Mitre link : CVE-2026-100502

CVE.ORG link : CVE-2026-100502

JSON object : View

Products Affected

No product.

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2026-100502", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-100502", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T00:12:58.424687Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 0.7}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "pawelmalak", "product": "flame", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.4.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-25T22:17:10.947", "references": [{"url": "https://github.com/pawelmalak/flame", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/pawelmalak/flame/blob/v2.4.0/controllers/auth/login.js#L9-L17", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/pawelmalak/flame/blob/v2.4.0/utils/init/initSecret.js#L8-L25", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/pawelmalak/flame/blob/v2.4.0/utils/signToken.js#L4", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/pawelmalak/flame/issues/494", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/flame-through-2.4.0-admin-token-insufficient-session-expiration", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/pawelmalak/flame/issues/494", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated."}], "lastModified": "2026-09-30T16:39:29.870", "sourceIdentifier": "disclosure@vulncheck.com"}