Vulnerability
CVE-2026-100502
Descriptive record received from OpenCTI and minimised for consultation in the Intel portal.
- Sharing
- PUBLIC-OSINT
- Confidence
- 100
- Source
- The CVE Program
- Updated
- 26/09/2026 03:13
Description
Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.
Aliases and classifications
CWE-613Insufficient Session Expiration
Minimised technical details
No raw data- cisa kev
- False
- cvss score
- 5
- cvss vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N
- cvss severity
- MEDIUM
Provenance
Public references
- JWT secret persisted once in data/.secret, never rotated
https://github.com/pawelmalak/flame/blob/v2.4.0/utils/init/initSecret.js - login passes client-supplied duration to signToken
https://github.com/pawelmalak/flame/blob/v2.4.0/controllers/auth/login.js - VulnCheck Advisory: Flame through 2.4.0 Admin Token Insufficient Session Expiration
https://www.vulncheck.com/advisories/flame-through-2.4.0-admin-token-insufficient-session-expiration - JWT signed with caller-chosen expiresIn
https://github.com/pawelmalak/flame/blob/v2.4.0/utils/signToken.js - GitHub Issue #494 (finding 5)
https://github.com/pawelmalak/flame/issues/494 - product
https://github.com/pawelmalak/flame
EudorIA correlation
Intel catalogue
The vulnerability is also available in the EudorIA editorial catalogue.
Open EudorIA analysisPresence in OpenCTI describes an intelligence correlation and does not, by itself, constitute evidence of compromise, legal attribution or operational guidance applicable without context verification.