CVE-2026-100501

Name of the Vulnerable Software and Affected Versions Flame versions prior to 2.4.1

Description An improper restriction of excessive authentication attempts exists in the 'POST /api/auth' login endpoint. This allows unauthenticated attackers to perform brute-force attacks against the admin password because the system lacks rate limiting, attempt counters, lockouts, or delays. Successful exploitation can lead to full administrator access and the ability to modify application configuration.

Recommendations Update Flame to a version later than 2.4.0. As a temporary workaround, restrict access to the 'POST /api/auth' endpoint to minimize the risk of brute-force attacks.