Vulnerability in Pawelmalak Flame
CVE-2026-100501
Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt counters, lockouts, or delays to gain full administrator access and modify application configuration.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N.
EPSS exploit prediction
EPSS: 0.003 (21.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 22nd percentile — 21.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
Weakness classification (CWE)
References
- github.com/pawelmalak/flame (product)
- Docker image default PASSWORD (technical-description)
- login compares the single admin password and issues a JWT (technical-description)
- POST /api/auth registered with no rate limiting (technical-description)
- GitHub Issue #494 (finding 1) (issue-tracking)
- VulnCheck Advisory: Flame through 2.4.0 Brute-Force Attack via Login Endpoint (third-party-advisory)
Frequently asked questions
- What is CVE-2026-100501?
- CVE-2026-100501 is a medium-severity vulnerability in Pawelmalak Flame, classified under Improper Restriction of Excessive Authentication Attempts. CVSS score: 6.5/10. Published 2026-09-25.
- How severe is CVE-2026-100501?
- Medium severity. CVSS v3 base score is 6.5 out of 10.