CVE-2026-100501CWE-307

CVE-2026-100501

Medium · published September 26, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
20.6
In the wild
Unconfirmed
What it is

Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt counters, lockouts, or delays to gain full administrator access and modify application configuration.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
CVSS v4.0
8.3 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00292 · 20.6th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2026-09-26T02:17Z
References (6)
https://github.com/pawelmalak/flame · [email protected]https://github.com/pawelmalak/flame/blob/v2.4.0/.docker/Dockerfile#L28 · [email protected]https://github.com/pawelmalak/flame/blob/v2.4.0/controllers/auth/login.js#L11-L22 · [email protected]https://github.com/pawelmalak/flame/blob/v2.4.0/routes/auth.js#L7 · [email protected]https://github.com/pawelmalak/flame/issues/494 · [email protected]https://www.vulncheck.com/advisories/flame-through-2.4.0-brute-force-attack-via-login-endpoint · [email protected]
EPSS history
Timeline
  • 27 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 25 SEP 22:04Z
    Flame through 2.4.0 Brute-Force Attack via Login Endpoint
    cvelistv5