Executive brief
The IRIS web application, a platform used for incident response and digital forensics, contains a security flaw in its multi-factor authentication (MFA) process. The system does not limit the number of times a user can attempt to enter an MFA code, which could allow an attacker to repeatedly guess the code until they gain access. If successful, this could lead to unauthorized access to sensitive investigative data and incident reports.
Technical details
The IRIS web application (iris-web) version 2.4.26 is vulnerable to a brute-force attack due to missing rate limiting or throttling on its Multi-Factor Authentication (MFA) validation endpoint. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). An unauthenticated remote attacker who has already obtained a user's primary credentials could potentially bypass the second layer of security by programmatically guessing the MFA token. The attack complexity is considered high as it requires the attacker to have valid primary credentials and perform the brute-force within the token's validity window. No specific patch version was confirmed in the advisory, though the issue was disclosed by SBA Research.
Affected products
- DFIR-IRIS IRIS-Web 2.4.26
Timeline
- 2026-07-30: advisory
- 2026-07-30: disclosed