CVE-2026-100502
Last modified
CVE-2026-100502 is a medium-severity vulnerability rated 5/10 on the CVSS scale. Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated..
Description
Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| pawelmalak | flame | <= 2.4.0 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-100502?
How severe is CVE-2026-100502?
How do I fix CVE-2026-100502?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-10045Shenzhen Kangda Xin Intelligent Network Technology Company's…9.8
- CVE-2026-10046Bitdefender Napoca bare-metal hypervisor contains an out-of-…7.8
- CVE-2026-10047The Bitdefender Napoca bare-metal hypervisor contains an out…7.8
- CVE-2026-1005Integer underflow in wolfSSL packet sniffer <= 5.8.4 allows …5.3
- CVE-2026-10050In Eclipse Jetty, the Digest authentication server-side comp…9.1
- CVE-2026-100501Flame through 2.4.0 contains an improper restriction of exce…6.5
- CVE-2026-100503Ghidra versions through 12.1.4 contain a heap use-after-free…3.3
- CVE-2026-100504Ghidra versions through 12.1.4 contain a stack-based out-of-…7
- CVE-2026-100505Ghidra versions 11.2 through 12.1.4 contain a heap out-of-bo…4.4
- CVE-2026-10051In Eclipse Jetty, a first HTTP/1.1 request with trailers cau…7.5
- CVE-2026-10052A flaw was found in the Quay config-tool's LDAP and SMTP val…4.1
- CVE-2026-100520Laranode versions before 1.2.1 contain a path traversal vuln…8.8
Are you affected by CVE-2026-100502?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST