Threats affecting pkg:github/pawelmalak/flame

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.

Flame versions up to and including 2.4.0 have a vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to perform unlimited brute-force attempts on the admin password. There are no rate limits, attempt counters, lockouts, or delays, enabling attackers to gain full administrator access and modify application configuration.

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single unauthenticated request to consume provider quota or access sensitive configuration data.