CVE-2026-100502: Flame through 2.4.0 Admin Token Insufficient Session Expiration
Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs former administrator access and the ability to use the login endpoint to request a token. It is not described as exploitable by an unauthenticated or low-privileged user.
What access could a successful attacker retain?
The attacker can obtain an administrator token with an arbitrary, near-permanent lifetime and retain full dashboard control. The token can remain valid after password changes because verification relies on a static JWT secret that is not rotated.
How can I determine whether previously issued administrator tokens may still be valid?
Administrators should treat tokens issued to former administrators as potentially persistent if they could have supplied a custom duration parameter when logging in. Password changes alone do not invalidate these tokens under the described design.