CVE-2026-100502

Received Received - Intake

Flame through Session Token Persistence Flaw

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: VulnCheck

Description

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-100502

Affected Vendors & Products

Vendor	Product	Version / Range
flame	flame	2.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

Flame through 2.4.0 has a session expiration flaw in its login endpoint. Attackers with past admin access can generate tokens with unlimited lifespans by manipulating duration parameters. These tokens bypass password changes because they rely on a static, unrotated JWT secret for verification, allowing persistent admin access to the dashboard.

Impact Analysis

If you use Flame through 2.4.0, attackers could regain admin access even after you change passwords. This could lead to unauthorized control of your dashboard, data theft, or system manipulation. The vulnerability enables long-term persistence without detection.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. GDPR and HIPAA mandate proper session management and user access controls. Persistent admin tokens could lead to unauthorized data access, breaching confidentiality and integrity requirements.

Mitigation Strategies

Rotate the JWT secret immediately to invalidate all existing tokens. Update Flame to the latest version beyond 2.4.0 to address the session expiration flaw. Review and revoke any near-permanent admin tokens issued before the secret rotation.

Hi! I’m here to help you understand CVE-2026-100502. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70