Flow FL-100

Published
August 2026
Updated
August 2026
Lateral illustration of the human head with the dorsolateral prefrontal cortex highlighted in yellow.
Dorsolateral Prefrontal Cortex (dlPFC)

Overview

Flow FL-100 is a consumer transcranial direct current stimulation (tDCS) headset for depression, controlled from a companion application over Bluetooth Low Energy (BLE). It delivers 2 mA of direct current to the dorsolateral prefrontal cortex through an F3/F4 bifrontal montage. This report documents a hard-coded-credential vulnerability in the device's Bluetooth interface.

Security findings

Coordinated Vulnerability Disclosure

CWE-798 • Use of Hard-coded Credentials

CWE
CWE-798
CVSS v3
8.1
CVSS v4
7.2

Affected units carry an undocumented hard-coded credential, shared across all devices, that is authorized to bypass authentication. An attacker within Bluetooth range can use it to arbitrarily manipulate the device's brain-stimulation parameters and state, including overriding safety limits.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Flow Neuroscience released a firmware fix; affected users should update through the Flow app.

Disclosure timeline

  1. Initial vulnerability report to CNA (CISA ICS)
  2. Vendor released a firmware fix
  3. CVE entry published

External links

  1. CVE-2026-18164 (nist.gov)
  2. EUVD-2026-58274 (europa.eu)
  3. CISA ICSMA-26-225-01 (cisa.gov)

Revision history

August 2026
Initial release following public disclosure of CVE-2026-18164.