{"id":"CVE-2026-100501","title":"Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password","summary":"Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit un…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","cwe":["CWE-307"],"vendor":"pawelmalak","product":"flame","affected":["flame <= 2.4.0"],"published":"2026-09-25","updated":"2026-09-25","sourceUpdated":"2026-09-25T22:17:10.793","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100501","references":[{"url":"https://github.com/pawelmalak/flame","label":"disclosure@vulncheck.com"},{"url":"https://github.com/pawelmalak/flame/blob/v2.4.0/.docker/Dockerfile#L28","label":"disclosure@vulncheck.com"},{"url":"https://github.com/pawelmalak/flame/blob/v2.4.0/controllers/auth/login.js#L11-L22","label":"disclosure@vulncheck.com"},{"url":"https://github.com/pawelmalak/flame/blob/v2.4.0/routes/auth.js#L7","label":"disclosure@vulncheck.com"},{"url":"https://github.com/pawelmalak/flame/issues/494","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/flame-through-2.4.0-brute-force-attack-via-login-endpoint","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-25T22:20:31.554Z","slug":"CVE-2026-100501","body":"## Overview\n\nFlame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt counters, lockouts, or delays to gain full administrator access and modify application configuration.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}