CVE-2026-100502 debrief based on insufficient session expiration in Flame 2.4.0 login endpoint. The vulnerability allows attackers with former admin access to obtain tokens with arbitrary lifespans, potentially retaining full control of the dashboard. This issue arises from the login endpoint's insufficient session expiration, which enables the creation of near-permanent administrator tokens that survive [truncated]
CVE-2026-100501 is a high-severity vulnerability in Flame through 2.4.0, allowing unauthenticated attackers to brute-force the admin password via the POST /api/auth login endpoint without rate limiting or other protective measures. The vulnerability is caused by an improper restriction of excessive authentication attempts, which enables attackers to submit unlimited password guesses without rate limiting, [truncated]
CVE-2026-100418 is a medium-severity information exposure vulnerability in Flame through 2.4.0. This vulnerability allows unauthenticated attackers to retrieve sensitive configuration data, including a stored weather API key, by sending a GET request to the /api/config endpoint. The vulnerability exists due to the endpoint returning the entire configuration object without field redaction. Defenders should [truncated]
