Is CVE-2026-100502 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100502 being exploited in the wild.

How severe is CVE-2026-100502?

Medium severity, with a CVSS score of 5, published 25 September 2026.

Which products and versions are affected?

Pawelmalak Flame through 2.4.0.

Is there a fix for CVE-2026-100502?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-100502 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-100502?

Check whether you run Pawelmalak Flame at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100502: Flame insufficient session expiration in login endpoint

CVE-2026-100502 · Severity: medium · CVSS 5 · Published 2026-09-25

Flame is a self-hosted dashboard application that manages apps and bookmarks. An attacker who previously had admin access can create administrator tokens with arbitrarily long lifespans by providing unchecked duration parameters, allowing them to retain persistent control of the dashboard even after their original credentials are revoked or passwords changed.

Technologies: Pawelmalak Flame. Vendors: Pawelmalak.

Quick answers

Is CVE-2026-100502 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100502 being exploited in the wild.
How severe is CVE-2026-100502?: Medium severity, with a CVSS score of 5, published 25 September 2026.
Which products and versions are affected?: Pawelmalak Flame through 2.4.0.
Is there a fix for CVE-2026-100502?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-100502 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-100502?: Check whether you run Pawelmalak Flame at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The login endpoint in Flame's auth controller accepts an unauthenticated duration parameter passed directly to the signToken function without validation, allowing attackers to mint JWT tokens with arbitrary expiration times. The vulnerability is exploitable only by attackers with former admin access who can interact with the login endpoint; tokens are validated against a static, non-rotated JWT secret, meaning long-lived tokens bypass authentication and authorization checks indefinitely.

Affected products

pawelmalak Flame through 2.4.0

Timeline

2026-09-25: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.