Vulnerability · Published Sep 25, 2026 · Assigned by VulnCheck

CVE-2026-100501Flame through 2.4.0 Brute-Force Attack via Login Endpoint

Medium 6.5

In plain English

A medium-severity security flaw in flame from pawelmalak. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 78.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt counters, lockouts, or delays to gain full administrator access and modify application configuration.

Affected products (as reported)

Vendor	Product	Versions
pawelmalak	flame	0 – through 2.4.0

Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

References

GitHub Issue #494 (finding 1) issue-tracking
POST /api/auth registered with no rate limiting technical-description
login compares the single admin password and issues a JWT technical-description
Docker image default PASSWORD technical-description
https://github.com/pawelmalak/flame product
VulnCheck Advisory: Flame through 2.4.0 Brute-Force Attack via Login Endpoint third-party-advisory