CVE-2026-18164: Flow Neuroscience FL-100 Use of Hard-coded Credentials

Published Aug 13, 2026

Updated

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state.

Affected Software

1 affected component

Flow Neuroscience FL-100

Event History

Aug 13, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-18164?

The severity of CVE-2026-18164 is rated high with a score of 8.1.

What risks are associated with CVE-2026-18164?

CVE-2026-18164 poses a risk of unauthorized manipulation of brain stimulation parameters due to hard-coded credentials.

How do I fix CVE-2026-18164?

To fix CVE-2026-18164, ensure that device units are updated to the latest firmware that eliminates the use of hard-coded credentials.

Who is impacted by CVE-2026-18164?

Users of the Flow Neuroscience FL-100 device are impacted by CVE-2026-18164 due to its use of hard-coded credentials.

What can an attacker do with CVE-2026-18164?

An attacker within Bluetooth range can use CVE-2026-18164 to bypass authentication and manipulate brain stimulation parameters.

CVE-2026-18164: Flow Neuroscience FL-100 Use of Hard-coded Credentials

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-18164?

What risks are associated with CVE-2026-18164?

How do I fix CVE-2026-18164?

Who is impacted by CVE-2026-18164?

What can an attacker do with CVE-2026-18164?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-18164?

What risks are associated with CVE-2026-18164?

How do I fix CVE-2026-18164?

Who is impacted by CVE-2026-18164?

What can an attacker do with CVE-2026-18164?