CVE-2026-100502 (GCVE-0-2026-100502)
Vulnerability from cvelistv5
Published
2026-09-25 22:04
Modified
2026-09-30 00:13
Severity ?
5.9 (Medium) - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
5.0 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N
CWE
  • CWE-613 - Insufficient Session Expiration
Summary
Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.
References
Impacted products
Vendor Product Version
pawelmalak flame Version: 0   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100502",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T00:12:58.424687Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T00:13:26.591Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/pawelmalak/flame/issues/494"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "flame",
          "vendor": "pawelmalak",
          "versions": [
            {
              "lessThanOrEqual": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Whispergate Security Research"
        }
      ],
      "datePublic": "2026-08-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T22:04:02.084Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #494 (finding 5)",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/pawelmalak/flame/issues/494"
        },
        {
          "name": "login passes client-supplied duration to signToken",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/pawelmalak/flame/blob/v2.4.0/controllers/auth/login.js#L9-L17"
        },
        {
          "name": "JWT signed with caller-chosen expiresIn",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/pawelmalak/flame/blob/v2.4.0/utils/signToken.js#L4"
        },
        {
          "name": "JWT secret persisted once in data/.secret, never rotated",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/pawelmalak/flame/blob/v2.4.0/utils/init/initSecret.js#L8-L25"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/pawelmalak/flame"
        },
        {
          "name": "VulnCheck Advisory: Flame through 2.4.0 Admin Token Insufficient Session Expiration",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/flame-through-2.4.0-admin-token-insufficient-session-expiration"
        }
      ],
      "title": "Flame through 2.4.0 Admin Token Insufficient Session Expiration",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-100502",
    "datePublished": "2026-09-25T22:04:02.084Z",
    "dateReserved": "2026-09-25T21:55:56.367Z",
    "dateUpdated": "2026-09-30T00:13:26.591Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"shortName\": \"VulnCheck\", \"dateUpdated\": \"2026-09-25T22:04:02.084Z\"}, \"datePublic\": \"2026-08-17T00:00:00.000Z\", \"title\": \"Flame through 2.4.0 Admin Token Insufficient Session Expiration\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"Insufficient Session Expiration\", \"cweId\": \"CWE-613\", \"type\": \"CWE\"}]}], \"affected\": [{\"vendor\": \"pawelmalak\", \"product\": \"flame\", \"defaultStatus\": \"unaffected\", \"versions\": [{\"version\": \"0\", \"status\": \"affected\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"2.4.0\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"HIGH\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"baseScore\": 5.9, \"baseSeverity\": \"MEDIUM\"}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"baseScore\": 5, \"baseSeverity\": \"MEDIUM\"}}], \"references\": [{\"url\": \"https://github.com/pawelmalak/flame/issues/494\", \"tags\": [\"issue-tracking\"], \"name\": \"GitHub Issue #494 (finding 5)\"}, {\"url\": \"https://github.com/pawelmalak/flame/blob/v2.4.0/controllers/auth/login.js#L9-L17\", \"tags\": [\"technical-description\"], \"name\": \"login passes client-supplied duration to signToken\"}, {\"url\": \"https://github.com/pawelmalak/flame/blob/v2.4.0/utils/signToken.js#L4\", \"tags\": [\"technical-description\"], \"name\": \"JWT signed with caller-chosen expiresIn\"}, {\"url\": \"https://github.com/pawelmalak/flame/blob/v2.4.0/utils/init/initSecret.js#L8-L25\", \"tags\": [\"technical-description\"], \"name\": \"JWT secret persisted once in data/.secret, never rotated\"}, {\"url\": \"https://github.com/pawelmalak/flame\", \"tags\": [\"product\"]}, {\"name\": \"VulnCheck Advisory: Flame through 2.4.0 Admin Token Insufficient Session Expiration\", \"tags\": [\"third-party-advisory\"], \"url\": \"https://www.vulncheck.com/advisories/flame-through-2.4.0-admin-token-insufficient-session-expiration\"}], \"credits\": [{\"lang\": \"en\", \"value\": \"Whispergate Security Research\", \"type\": \"finder\"}], \"x_generator\": {\"engine\": \"vulncheck-endgame\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-100502\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-30T00:12:58.424687Z\"}}}], \"references\": [{\"url\": \"https://github.com/pawelmalak/flame/issues/494\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-30T00:13:03.739Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-100502\", \"assignerOrgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"VulnCheck\", \"dateReserved\": \"2026-09-25T21:55:56.367Z\", \"datePublished\": \"2026-09-25T22:04:02.084Z\", \"dateUpdated\": \"2026-09-30T00:13:26.591Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.