{"cve":"CVE-2026-100502","nvd":{"published":"2026-09-25T22:17:10.947","modified":"2026-09-30T16:39:29.870","status":"Deferred","description":"Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","score":5.9},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N","score":5.0},"cwes":["CWE-613"],"references":["https://github.com/pawelmalak/flame","https://github.com/pawelmalak/flame/blob/v2.4.0/controllers/auth/login.js#L9-L17","https://github.com/pawelmalak/flame/blob/v2.4.0/utils/init/initSecret.js#L8-L25","https://github.com/pawelmalak/flame/blob/v2.4.0/utils/signToken.js#L4","https://github.com/pawelmalak/flame/issues/494"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:56:48.555445741+00:00"},"epss":{"cve":"CVE-2026-100502","score":0.00364,"percentile":0.2994,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}