This vulnerability allows an attacker who is not logged in to repeatedly submit login attempts to the POST /api/auth endpoint. Because the application does not enforce any limits on the number of attempts, the attacker can perform a credential‑guessing attack on the administrator account. Successful brute‑forcing results in full administrator privileges, enabling the attacker to change configuration settings and potentially gain persistent access to the deployment.

The issue applies to the Flame application developed by pawelmalak. Any deployment running version 2.4.0 or earlier is affected, as the vulnerability exists in the code present in the v2.4.0 release.

The CVSS score of 8.3 indicates a high severity. There is no EPSS value available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending repeated HTTP POST requests to the login endpoint, and no special privileges are required to perform the attack. As a result, the risk of credential compromise and subsequent privilege escalation remains significant until mitigated.