Flame Dashboard CVE-2026-100502

Requires that the attacker previously held administrator access to the Flame dashboard (PR:H) - this is a persistence/re-entry flaw, not initial access. Exploitation succeeds because the login endpoint accepts an attacker-controlled, unvalidated token duration parameter and Flame signs all tokens with a single static JWT secret generated once (initSecret.js) and never rotated, so previously issued tokens remain valid across password changes and admin deprovisioning. What LIMITS exploitation: the attacker must already possess valid admin credentials/session at least once; the flaw does not help an unprivileged remote attacker gain first-time access. Mitigation hinges on rotating the JWT secret (which the current code does not do), which is not exposed as a routine operation.

This is a moderate-severity persistence flaw, not a high-priority mass-exploitation risk. The CVSS 4.0 score of 5.9 (AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N) is honest: PR:H and AT:P reflect that the attacker must ALREADY possess admin access (a 'former admin'), so this is a post-compromise persistence primitive rather than an initial-access vector. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is: no public exploit identified at time of analysis. The primary impact is integrity (VI:H) - minting long-lived tokens that survive password changes because the JWT secret is static and never rotated - with only minor confidentiality exposure (VC:L). Note a data conflict: the input Tags label this 'Information Disclosure,' but the CWE-613 (insufficient session expiration) and the integrity-dominant vector show this is a broken-session-management / privilege-persistence issue, not info disclosure - the tag is mislabeled. There is no SSVC decision data supplied. Net: a real but low-urgency issue whose blast radius is limited to environments where an admin credential was already exposed or an admin was deprovisioned without rotating the JWT secret.

A user who once held Flame admin access (e.g., a departed employee or a temporarily-compromised admin session) calls the login endpoint and supplies an arbitrary, oversized duration parameter, minting a JWT valid for years. Because tokens are signed with a static, never-rotated secret and are not invalidated on password change, the attacker retains full dashboard control even after the organization 'revokes' access by resetting the admin password. No public POC is identified, and the CVSS AC:H/AT:P indicates the attack depends on the attacker's prior privilege rather than being trivially repeatable.