Executive brief
The IRIS web application, a platform used for incident response and digital forensics, contains a flaw where the logout button does not properly terminate a user's session. If an attacker gains physical access to a device or manages to steal a session cookie, they could continue to access the user's account even after the user believes they have logged out. This could lead to unauthorized access to sensitive investigation data and case files.
Technical details
The IRIS web application (version 2.4.26) suffers from insufficient session expiration (CWE-613) due to an ineffective logout mechanism. When a user triggers the logout function, the server-side session remains active or the session token is not properly invalidated. An attacker who obtains a valid session cookie—via physical access to the machine or other means—can continue to authenticate to the application indefinitely or until the session naturally expires. The CVSS vector indicates a high complexity attack requiring physical access to the target environment.
Affected products
- DFIR-IRIS IRIS web application 2.4.26
Timeline
- 2026-07-30: advisory: NVD publication date
- 2026-07-30: disclosed: SBA Research advisory published