Vulnerability · Published Sep 25, 2026 · Assigned by VulnCheck

CVE-2026-100502Flame through 2.4.0 Admin Token Insufficient Session Expiration

Medium 5.0

In plain English

A medium-severity security flaw in flame from pawelmalak. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.4%top 69.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.

Affected products (as reported)

Vendor	Product	Versions
pawelmalak	flame	0 – through 2.4.0

Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N

References

GitHub Issue #494 (finding 5) issue-tracking
login passes client-supplied duration to signToken technical-description
JWT signed with caller-chosen expiresIn technical-description
JWT secret persisted once in data/.secret, never rotated technical-description
https://github.com/pawelmalak/flame product
VulnCheck Advisory: Flame through 2.4.0 Admin Token Insufficient Session Expiration third-party-advisory