Vulnerability in Pawelmalak Flame
CVE-2026-100502
Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N.
EPSS exploit prediction
EPSS: 0.004 (30.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 30th percentile — 30.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001
Affected products
Weakness classification (CWE)
References
- github.com/pawelmalak/flame (product)
- login passes client-supplied duration to signToken (technical-description)
- JWT secret persisted once in data/.secret, never rotated (technical-description)
- JWT signed with caller-chosen expiresIn (technical-description)
- GitHub Issue #494 (finding 5) (issue-tracking)
- VulnCheck Advisory: Flame through 2.4.0 Admin Token Insufficient Session Expiration (third-party-advisory)
Frequently asked questions
- What is CVE-2026-100502?
- CVE-2026-100502 is a medium-severity vulnerability in Pawelmalak Flame, classified under Insufficient Session Expiration. CVSS score: 5.0/10. Published 2026-09-25.
- How severe is CVE-2026-100502?
- Medium severity. CVSS v3 base score is 5.0 out of 10.