CVE-2026-100502

MEDIUM 5.0

Flame through 2.4.0 Admin Token Insufficient Session Expiration

CVSS Score

5.0

EPSS Score

0.0%

EPSS Percentile

0th

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.

CWE	CWE-613
Vendor	pawelmalak
Product	flame
Published	Sep 25, 2026

Stay Ahead of the Next One

Get instant alerts for pawelmalak flame

Be the first to know when new medium vulnerabilities affecting pawelmalak flame are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Affected Versions

pawelmalak / flame

0 ≤ 2.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/pawelmalak/flame/issues/494 github.com: https://github.com/pawelmalak/flame/blob/v2.4.0/controllers/auth/login.js#L9-L17 github.com: https://github.com/pawelmalak/flame/blob/v2.4.0/utils/signToken.js#L4 github.com: https://github.com/pawelmalak/flame/blob/v2.4.0/utils/init/initSecret.js#L8-L25 github.com: https://github.com/pawelmalak/flame vulncheck.com: https://www.vulncheck.com/advisories/flame-through-2.4.0-admin-token-insufficient-session-expiration

Credits

Whispergate Security Research