Hard-coded Authentication Credentials in Flow Neuroscience FL-100

Flow Neuroscience has identified a critical security vulnerability, CVE-2026-18164, affecting the FL-100 brain stimulation medical device. The vulnerability is rooted in the use of hard-coded credentials that are shared across all device units. An attacker positioned within Bluetooth range of a vulnerable device can leverage these credentials to bypass authentication mechanisms. Once authenticated, the attacker can manipulate brain stimulation parameters and override safety limit thresholds. This flaw poses a significant risk to the health and safety of patients, as the unauthorized modification of device output could result in unintended medical impact. The issue affects all Flow Neuroscience FL-100 and Halo Neuroscience FL-100 devices with firmware versions released prior to July 2026. Defenders should prioritize applying the vendor-supplied firmware updates via the official mobile application to remediate this authentication bypass.

Impact

Successful exploitation of this vulnerability allows unauthorized control over medical device settings by an actor within physical Bluetooth range. While there are no reports of active exploitation in the wild, the potential impact includes physical harm to patients due to the manipulation of brain stimulation levels and the disabling of device-level safety overrides. The vulnerability is classified as high-severity, impacting both the Flow Neuroscience and Halo Neuroscience product lines worldwide.

Recommendation

• Ensure all affected Flow Neuroscience FL-100 and Halo Neuroscience FL-100 units are updated to the latest firmware version released by the manufacturer after July 2026 via the Flow app.
• Implement physical access controls and security awareness training to limit unauthorized proximity to medical devices in healthcare settings.
• Monitor for unauthorized Bluetooth pairing attempts or abnormal device management activity in environments where these units are deployed.