CVE-2026-100502CWE-613

CVE-2026-100502

Medium · published September 26, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
20.4
In the wild
Unconfirmed
What it is

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N
CVSS v4.0
5.9 · CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00289 · 20.4th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-09-26T02:17Z
References (7)
https://github.com/pawelmalak/flame · [email protected]https://github.com/pawelmalak/flame/blob/v2.4.0/controllers/auth/login.js#L9-L17 · [email protected]https://github.com/pawelmalak/flame/blob/v2.4.0/utils/init/initSecret.js#L8-L25 · [email protected]https://github.com/pawelmalak/flame/blob/v2.4.0/utils/signToken.js#L4 · [email protected]https://github.com/pawelmalak/flame/issues/494 · [email protected]https://www.vulncheck.com/advisories/flame-through-2.4.0-admin-token-insufficient-session-expiration · [email protected]https://github.com/pawelmalak/flame/issues/494 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 25 SEP 22:04Z
    Flame through 2.4.0 Admin Token Insufficient Session Expiration
    cvelistv5