CVE-2026-100502
MEDIUM
5,9
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: high
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
5,0
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: high
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: high
Availability: none
Description
AI Translation Available
Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.
613
Insufficient Session Expiration
IncompleteCommon Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Applicable Platforms
Technologies:
Web Based, Web Server
https://github.com/pawelmalak/flame
https://github.com/pawelmalak/flame/blob/v2.4.0/controllers/auth/login.js#L9-L17
https://github.com/pawelmalak/flame/blob/v2.4.0/utils/init/initSecret.js#L8-L25
https://github.com/pawelmalak/flame/blob/v2.4.0/utils/signToken.js#L4
https://github.com/pawelmalak/flame/issues/494
https://www.vulncheck.com/advisories/flame-through-2.4.0-admin-token-insufficie…