CVE-2026-100502
Flame through 2.4.0 Admin Token Insufficient Session Expiration
- State
- Published
- Severity
- 5.9 Medium
- Published
- Sep 25, 2026
- Updated
- Sep 30, 2026
- Reserved
- Sep 25, 2026
Description
Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.9 Medium | CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.0 Medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N | VulnCheck |
Weaknesses
- CWE-613 Insufficient Session Expiration
Affected Products
| Product | Versions |
|---|---|
flamepawelmalak |
|
References
- GitHub Issue #494 (finding 5)issue-tracking
- login passes client-supplied duration to signTokentechnical-description
- JWT signed with caller-chosen expiresIntechnical-description
- JWT secret persisted once in data/.secret, never rotatedtechnical-description
- https://github.com/pawelmalak/flameproduct
- VulnCheck Advisory: Flame through 2.4.0 Admin Token Insufficient Session Expirationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.