CVE-2026-100502

Katalog CVE

CVSS 5.0 · Medium EPSS 0,29%

Kerentanan Insufficient Session Expiration. Skor CVSS 3.1 5.0 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.

Rincian

Terbit di NVD

25 September 2026

Terakhir diubah

30 September 2026

Status NVD

Deferred

CVSS 3.1

5.0 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-613: Insufficient Session Expiration

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 19,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/pawelmalak/flame
• https://github.com/pawelmalak/flame/blob/v2.4.0/controllers/auth/login.js#L9-L17
• https://github.com/pawelmalak/flame/blob/v2.4.0/utils/init/initSecret.js#L8-L25
• https://github.com/pawelmalak/flame/blob/v2.4.0/utils/signToken.js#L4
• https://github.com/pawelmalak/flame/issues/494
• https://www.vulncheck.com/advisories/flame-through-2.4.0-admin-token-insufficient-session-expiration