Threat Intelligence Database

CVE-2026-100502 is a vulnerability in pawelmalak flame through version 2.4.0 involving insufficient session expiration on the login endpoint. Attackers with prior admin access can exploit this flaw by supplying unvalidated duration parameters to obtain tokens with arbitrary lifespans. These tokens can be near-permanent administrator tokens that persist even after password changes, as token verification relies on a static JWT secret that is never rotated.

CVE-2026-100501 is a high-severity vulnerability in pawelmalak flame through version 2.4.0. It involves improper restriction of excessive authentication attempts on the POST /api/auth login endpoint. This flaw allows unauthenticated attackers to perform unlimited brute-force attempts against the admin password without any rate limiting, attempt counters, lockouts, or delays. Successful exploitation grants full administrator access, enabling attackers to modify application configuration.

Flame through version 2.4.0 has an information exposure vulnerability in the unauthenticated GET /api/config endpoint. This endpoint returns the entire configuration object without redacting sensitive fields, allowing attackers to retrieve sensitive data such as the stored weather API key and internal operational settings. This can lead to unauthorized consumption of provider quota and exposure of confidential configuration information.