CVE-2026-100501: Flame through 2.4.0 Brute-Force Attack via Login Endpoint
Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt counters, lockouts, or delays to gain full administrator access and modify application configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Protect the POST /api/auth login endpoint with rate limiting, authentication-attempt counters, account lockouts, or login delays to prevent unlimited password guesses.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any reachable Flame instance through version 2.4.0 is exposed if its POST /api/auth endpoint can be accessed by an unauthenticated attacker. The issue targets the administrator login.
What does an attacker need to exploit it?
An attacker only needs network access to the POST /api/auth login endpoint. No account, prior authentication, or user interaction is required, but successful compromise depends on guessing the administrator password.
Are login protections available by default?
The affected login endpoint has no rate limiting, attempt counter, account lockout, or delay for failed password guesses. Attackers can submit unlimited authentication attempts.
What is the impact of a successful attack?
A successful brute-force attack gives the attacker full administrator access. They can then modify the application configuration.