# CVE-2026-16970: DFIR-IRIS IRIS Web insufficient session expiration in logout function

Source: https://junglewise.ai/threats/cve-2026-16970-dfir-iris-iris-web-insufficient-session-expiration-in-logout  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-16970 · Severity: medium · CVSS 4.2 · Published 2026-07-30

The IRIS web application, a platform used for incident response and digital forensics, contains a flaw where the logout button does not properly terminate a user's session. If an attacker gains physical access to a device or manages to steal a session cookie, they could continue to access the user's account even after the user believes they have logged out. This could lead to unauthorized access to sensitive investigation data and case files.

Technologies: [DFIR-IRIS Iris](https://junglewise.ai/threats/technologies/iris). Vendors: [DFIR-IRIS](https://junglewise.ai/threats/vendors/dfir-iris).

## Quick answers

**Is CVE-2026-16970 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16970 being exploited in the wild.

**How severe is CVE-2026-16970?** Medium severity, with a CVSS score of 4.2, published 30 July 2026.

**Which products and versions are affected?** DFIR-IRIS Iris 2.4.26.

**Is there a fix for CVE-2026-16970?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16970 attacked?** It is attacked with physical access, in a web application.

**Am I affected by CVE-2026-16970?** Check whether you run DFIR-IRIS Iris at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The IRIS web application (version 2.4.26) suffers from insufficient session expiration (CWE-613) due to an ineffective logout mechanism. When a user triggers the logout function, the server-side session remains active or the session token is not properly invalidated. An attacker who obtains a valid session cookie—via physical access to the machine or other means—can continue to authenticate to the application indefinitely or until the session naturally expires. The CVSS vector indicates a high complexity attack requiring physical access to the target environment.

## Affected products

- DFIR-IRIS IRIS web application 2.4.26

## Timeline

- 2026-07-30: advisory: NVD publication date
- 2026-07-30: disclosed: SBA Research advisory published

## References

- [https://github.com/sbaresearch/advisories/tree/public/2026/SBA-ADV-20260128-04_DFIR-IRIS_Insufficient_Logout](https://github.com/sbaresearch/advisories/tree/public/2026/SBA-ADV-20260128-04_DFIR-IRIS_Insufficient_Logout)

## Related threats

- [IRIS unauthorized comment enumeration via case access](https://junglewise.ai/threats/cve-2026-92605-iris-unauthorized-comment-enumeration-via-case-access)
- [DFIR-IRIS IRIS Web Stored XSS in datastore upload function](https://junglewise.ai/threats/cve-2026-18361-dfir-iris-iris-web-stored-xss-in-datastore-upload-function)
- [DFIR-IRIS IRIS Web Stored XSS in assets function](https://junglewise.ai/threats/cve-2026-16969-dfir-iris-iris-web-stored-xss-in-assets-function)
- [DFIR-IRIS IRIS incorrect authorization in alert management](https://junglewise.ai/threats/cve-2026-42547-dfir-iris-iris-incorrect-authorization-in-alert-management)
- [DFIR-IRIS IRIS CSRF via HTTP GET in state-changing endpoints](https://junglewise.ai/threats/cve-2026-42543-dfir-iris-iris-csrf-via-http-get-in-state-changing-endpoints)