CVE-2026-16971

The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.

Score

CVSS 3.1 5.9 Medium

Status

Deferred - 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a

Published

2026-07-30

Last modified

2026-10-23

Weaknesses

CWE-770

Affected products

• Iris-web (Dfir-iris)

References

• https://github.com/sbaresearch/advisories/tree/public/2026/SBA-ADV-20260128-02_DFIR-IRIS_Missing_Brute_Force_Protection