Flame version 2.4.0 contains a flaw in the login endpoint that allows an attacker who once had administrative access to request a new token with an arbitrary lifespan. The authentication logic accepts a duration parameter without validation and the token is signed with a static secret that is never rotated. As a result, an attacker can mint a near‑permanent administrator token that continues to grant full control of the dashboard even after the password is changed.

Flame (developed by pawelmalak) is the affected product, specifically versions that include the 2.4.0 release.

The CVSS score of 5.9 indicates a medium severity vulnerability. The EPSS score is not available, and the CVE is not listed in the CISA KEV catalog, suggesting that publicly known exploitation is not widespread yet. The likely attack vector is the web login API; an attacker needs prior admin access or valid credentials to supply the unvalidated duration parameter. Once the token is minted, the attacker retains persistent administrative control without any additional actions such as password changes or re‑authentication.