Quick answers
- Is CVE-2026-42329 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42329 being exploited in the wild.
- How severe is CVE-2026-42329?
- Medium severity, with a CVSS score of 4.7, published 4 June 2026.
- Which products and versions are affected?
- DFIR-IRIS Iris < 2.4.28.
- Is there a fix for CVE-2026-42329?
- A patch was published on 2026-04-27: Version 2.4.28 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-42329 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-42329?
- Check whether you run DFIR-IRIS Iris at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An open redirect vulnerability exists in the Iris web application due to insufficient validation of the 'next' parameter during the login process. An unauthenticated remote attacker can craft a URL containing a malicious domain in the redirect parameter (e.g., /login?next=attacker.com). When a victim clicks the link and successfully authenticates, the application issues a 302 redirect to the attacker-controlled site. This is classified as CWE-601 (URL Redirection to Untrusted Site) and was addressed in version 2.4.28 by implementing stricter input validation on redirect targets.
Affected products
- DFIR-IRIS iris-web < 2.4.28
Timeline
- 2026-01-26: other: Vulnerability identified by researchers
- 2026-01-30: other: Initial vendor contact
- 2026-04-27: patched: Version 2.4.28 released with fix
- 2026-05-28: advisory: GitHub security advisory published
- 2026-06-04: disclosed: NVD publication date