CVE-2026-100501
⚪ Do wiadomości
Niewłaściwe ograniczenie prób uwierzytelnienia w Flame umożliwia atakującym brutalne łamanie hasła administratora.
CVSS
6.5
EPSS
0.3%
Exploit
none
Vendor
Opis źródłowy (NVD)
Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt counters, lockouts, or delays to gain full administrator access and modify application configuration.
brak
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 6.5 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.3% |
| Opublikowano (NVD) | 2026-09-25 22:17:10 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-05 15:17:09 UTC |
Referencje
- https://github.com/pawelmalak/flame ([email protected])
- https://github.com/pawelmalak/flame/blob/v2.4.0/.docker/Dockerfile#L28 ([email protected])
- https://github.com/pawelmalak/flame/blob/v2.4.0/controllers/auth/login.js#L11-L22 ([email protected])
- https://github.com/pawelmalak/flame/blob/v2.4.0/routes/auth.js#L7 ([email protected])
- https://github.com/pawelmalak/flame/issues/494 ([email protected])
- https://www.vulncheck.com/advisories/flame-through-2.4.0-brute-force-attack-via-login-endpoint ([email protected])